A developer timeline can reveal employers, clients and private projects. Gitrospective limits the local import to the fields needed for a daily activity calendar.
Core principles
Gitrospective sends read requests to connected providers. Imported records keep their provider and account identifiers. Missing dates remain empty.
GitHub and GitLab data
The application imports profile details, repositories and contribution data exposed to the connected account. Provider access tokens are encrypted in the application database. GitHub’s classic OAuth scope includes private repository access because it has no read-only equivalent. The application code only makes read requests.
Local Git scanning
The optional CLI sends project names, normalized remotes, dates and commit counts. Source files and commit messages stay on the computer. The local Git history guide explains the scan in detail.
Security boundaries
Authentication tokens are encrypted in the application database. CLI credentials use the operating system credential store where available. Web sessions are stored in HTTP-only, same-site cookies and are marked secure in HTTPS production environments.
A production deployment also depends on database access, backup policy and server configuration.
Current limits and production responsibility
Before public launch, the operator must configure transport encryption, database access, backups, logs and account deletion. A complete legal privacy notice is also required for the countries where the service is offered.