gitgalaxy 2.3.43__tar.gz → 2.4.5__tar.gz

gitgalaxy-2.4.5/.github/workflows/dead-key-audit.yml

@@ -0,0 +1,29 @@
+name: Dead Key Audit
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  dead-key-audit:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        with:
+          python-version: "3.12"
+
+      # No pip install: dead_key_audit.py is stdlib-only (ast/json/argparse)
+      # by design, so this check stays fast and dependency-free.
+      - name: Run baseline-gated regression check (#325)
+        run: python tests/dead_key_audit.py --ci

{gitgalaxy-2.3.43 → gitgalaxy-2.4.5}/.github/workflows/deploy-docs.yml

@@ -27,7 +27,7 @@ jobs:
           git config user.email 41898282+github-actions[bot]@users.noreply.github.com
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 #
         with:
           python-version: "3.x"
 

gitgalaxy-2.4.5/.github/workflows/gitgalaxy.yml

@@ -0,0 +1,124 @@
+name: GitGalaxy Zero-Trust Pipeline
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  # ============================================================
+  # PRE-GATE — runs on every PR, blocks the merge on failure.
+  # Fast; no heavy ML/graph dependencies installed.
+  # ============================================================
+  vault-sentinel:
+    if: github.event_name == 'pull_request'
+    name: Vault Sentinel
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./
+        with:
+          tool: vault-sentinel
+          target: .
+          version: local
+
+  xray-inspector:
+    if: github.event_name == 'pull_request'
+    name: X-Ray Inspector
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./
+        with:
+          tool: xray-inspector
+          target: .
+          version: local
+
+  supply-chain-firewall:
+    if: github.event_name == 'pull_request'
+    name: Supply Chain Firewall
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./
+        with:
+          tool: supply-chain-firewall
+          target: .
+          version: local
+
+  # ============================================================
+  # POST-GATE — runs only once code is on main (merge or direct
+  # push). One galaxyscope pass produces all 6 outputs; we route
+  # 3 of them and let the rest live only in the ephemeral runner.
+  # --fail-on-malware stays on here too, as a safety net in case
+  # branch protection is ever bypassed.
+  # ============================================================
+  full-report:
+    if: github.event_name == 'push'
+    name: Full Report (SARIF, SBOM, LLM Brief)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write   # NEW — required for create-pull-request to open the PR
+      security-events: write
+    steps:
+      - name: Checkout Repository          # unchanged
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: true
+
+      - name: Setup Python                 # unchanged
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.12"
+          cache: "pip"
+
+      - name: Install GitGalaxy & Full Precision Engines   # unchanged
+        run: |
+          python -m pip install --upgrade pip
+          pip install gitgalaxy networkx tiktoken xgboost pandas numpy
+
+      - name: Run GalaxyScope (single pass — all 6 outputs)   # unchanged
+        env:
+          GITGALAXY_LICENSE_KEY: "COMMUNITY_FREE_TIER"
+        run: |
+          galaxyscope . --config .galaxyscope.yaml --fail-on-malware --output gitgalaxy-results.json
+
+      - name: Upload SARIF to GitHub Security Tab   # unchanged
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        with:
+          sarif_file: gitgalaxy-results_sarif.json
+
+      - name: Upload SBOM as Build Artifact   # unchanged
+        uses: actions/upload-artifact@v7
+        with:
+          name: gitgalaxy-sbom
+          path: gitgalaxy-results_sbom.json
+
+      # --- everything below here REPLACES the old "Commit LLM Brief to Docs" step ---
+      - name: Prepare LLM Brief
+        run: |
+          mkdir -p docs
+          mv *_galaxy_llm.md docs/gitgalaxy_architecture_brief.md
+
+      - name: Open PR with Updated LLM Brief
+        uses: squid-protocol/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # forked from peter-evans/create-pull-request v8.0.0
+        with:
+          token: ${{ secrets.AUTOMATION_PAT }}
+          commit-message: "docs: auto-update LLM architectural brief"
+          title: "docs: auto-update LLM architectural brief"
+          body: "Automated update from the latest GalaxyScope scan on `main`."
+          branch: auto/llm-architecture-brief
+          delete-branch: true
+          add-paths: docs/gitgalaxy_architecture_brief.md

{gitgalaxy-2.3.43 → gitgalaxy-2.4.5}/.github/workflows/muninn.yml

@@ -23,7 +23,7 @@ jobs:
 
       - name: Run Muninn
         # zizmor: ignore[github_action_from_unverified_creator_used]
-        uses: skaldlab/muninn@c3b5b13e4599d1c3f68280d24d64e403a306f542 # v0.3.4
+        uses: skaldlab/muninn@daf98872b5748d015ed5bd828296175f6bc0115d # v0.3.6
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           fail-on: info

{gitgalaxy-2.3.43 → gitgalaxy-2.4.5}/.github/workflows/smoke-test.yml

@@ -26,7 +26,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 #
         with:
           python-version: ${{ matrix.python-version }}
 

{gitgalaxy-2.3.43 → gitgalaxy-2.4.5}/.gitignore

@@ -102,3 +102,6 @@ tests/telemetry_out/
 
 # Force tracking of the Golden Master despite global *.json ignore
 !tests/golden_master_audit.json*.vsix
+
+# Force tracking of the Dead Key Auditor baseline (#325) despite global *.json ignore
+!tests/dead_key_audit_baseline.json

gitgalaxy-2.4.5/PKG-INFO

@@ -0,0 +1,265 @@
+Metadata-Version: 2.4
+Name: gitgalaxy
+Version: 2.4.5
+Summary: An AST-free, LLM-free zero-trust static analysis engine for mapping architectural risk, securing CI/CD pipelines, and modernizing legacy monoliths.
+Author: Joe Esquibel
+Project-URL: Homepage, https://gitgalaxy.io
+Project-URL: Documentation, https://squid-protocol.github.io/gitgalaxy/
+Project-URL: Source, https://github.com/squid-protocol/gitgalaxy
+Project-URL: Tracker, https://github.com/squid-protocol/gitgalaxy/issues
+Keywords: static-analysis,security,devsecops,visualization,ast,zero-trust,sbom,legacy-migration
+Classifier: Programming Language :: Python :: 3
+Classifier: Operating System :: OS Independent
+Classifier: Environment :: Console
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Topic :: Scientific/Engineering :: Visualization
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: PyYAML>=6.0
+Dynamic: license-file
+
+<div align="center">
+
+# GitGalaxy 
+
+[Docs](https://squid-protocol.github.io/gitgalaxy/) · [Visualizer](https://gitgalaxy.io/)
+
+[![PyPI version](https://badge.fury.io/py/gitgalaxy.svg)](https://badge.fury.io/py/gitgalaxy)
+[![Python 3.09+](https://img.shields.io/badge/python-3.09+-blue.svg)](https://www.python.org/downloads/)
+[![License: PolyForm Noncommercial](https://img.shields.io/badge/License-PolyForm%20Noncommercial-blue.svg)](https://polyformproject.org/licenses/noncommercial/1.0.0/)
+[![Velocity](https://img.shields.io/badge/Velocity-50k+_LOC%2Fs-00C957.svg)](#)
+[![Analysis](https://img.shields.io/badge/Analysis-Static_Analysis-00BFFF.svg)](#)
+[![Architecture](https://img.shields.io/badge/Architecture-Zero__Trust-teal.svg)](#)
+
+[![Zero Dependencies](https://img.shields.io/badge/Dependencies-0-brightgreen.svg)](https://pypi.org/project/gitgalaxy/)
+[![Airgap Ready](https://img.shields.io/badge/Security-Airgap_Ready-teal.svg)](#)
+
+</div>
+
+<div align="center">
+
+**1 scan** · **97 structural signals** · **50+ languages** · **0 need for compilation**<br>
+**19 risk exposure scores** · **6 final reports** · **0 dependencies** · `pip install gitgalaxy`
+
+</div>
+
+<div align="center">
+
+Gitgalaxy can assess full repos, comprised of mixes of 50+ different languages and map out the architecture, provide risk exposures and actionable fixes to lower those exposures. The graph below is a workflow from one gitgalaxy scan from on our golden test repo, which contains sample code files from the Apollo-11 1969 flight software through the modern tech stacks. [Benchmark](https://github.com/squid-protocol/language-crucible)   
+<img src="docs/wiki/assets/sankey_v4.3.1.png" alt="GitGalaxy Architecture Pipeline" width="100%">
+
+</div>
+
+<div>
+
+### **Whole-Repository Intelligence with a Unique Security Layer **
+
+Gitgalaxy is a tool to  determistically audit code, fast enough for the CI pipeline. Most code intelligence engines use an AST, like tree-sitter, which is offers an overly granular view of a repos (like asking to understand a house and getting a list of every brick and glass pane) and it limits the languages and files that can be scanned. Modern repos are poly-lingual. Many repos have old code without a good AST. To bypass this, Gitgalaxy uses a custom regex/lexical structural-analysis engine with a statistics layer on top — it builds a feature vector per file (from ~97 regex "signal" categories - that mark the boundaries of functions, control flow, I/O, state mutation, and dozens of other structural and security-relevant behaviors) and per repo (dependency graph via import resolution + PageRank/centrality), then transforms those raw counts into normalized 0–100 risk scores via sigmoid functions, and exports the result to six formats. 
+
+Gitgalaxy trades AST-level precision for orders-of-magnitude speed and universal language coverage, in the same spirit that [BLAST traded Smith-Waterman's](https://squid-protocol.github.io/gitgalaxy/03-01-claim-1-search-strategies/) exhaustive alignment for heuristic speed in genomics. Output includes SARIF, CycloneDX SBOM, a queryable SQLite knowledge graph, an LLM-optimized architecture brief, and 3D visualization data from a single scan pass that takes seconds. 
+
+The result is a deterministic knowledge graph of the repository, built without ever requiring the code to compile. It calculates the ratio of test code to core logic, maps each file's downstream "blast radius" through the dependency graph, and surfaces project-structure signal that line-by-line linters miss entirely. Per-file signal extraction runs in time linear to codebase size; repository-level graph metrics (centrality, community detection) use standard network-analysis algorithms with explicit sampling bounds on very large graphs.
+
+Our unique engine allows for the unique ways to scan for several CWEs families without the need for CVE lists, which is a unique edge for our code intelligence engine. 
+
+</div>
+
+<div>
+
+### Scanning Apollo-11 with the blAST Engine
+
+![GitGalaxy CLI Scan](https://raw.githubusercontent.com/squid-protocol/gitgalaxy/main/docs/wiki/assets/apollo11_scan.gif)
+
+</div>
+
+<div>
+
+## What GitGalaxy Finds — and What It Doesn't Claim
+
+GitGalaxy produces two different kinds of output, and they should be read differently.
+
+**Risk Exposure scores** are a 0–100, density-normalized signal across 19 categories
+(secrets, injection surface, memory corruption, and more), rolled up from function to
+file to folder to repository. A high score means *this deserves attention first* — it
+is a prioritization signal, not a verdict. Two files can carry the same score for
+completely different reasons: a real problem, or a legitimate pattern that looks
+identical on the surface. Encrypted malware and a well-tested cryptography routine
+both produce high entropy. GitGalaxy can't tell you which one it found — only that
+something worth a second look is there.
+
+**Findings** are individual, line-level flags: a specific Structural Signature that
+crossed a risk threshold. These are evidence to review, not confirmed vulnerabilities.
+GitGalaxy never executes code, traces runtime dataflow, or verifies exploitability —
+it tells you a pattern exists in the text, at this exact line, and hands you the
+context to judge it yourself.
+
+**This is intentional, not a limitation we're hiding.** GitGalaxy is built to err
+toward recall over precision: flag more, and let a human or a deeper tool narrow the
+list, rather than risk staying silent on something real. False positives are the
+expected cost of that trade-off, the same way they are for every static analyzer that
+doesn't execute the code it reads.
+
+That also means GitGalaxy is strongest against a specific class of problem —
+**negligence, not adversarial evasion.** A hardcoded key someone forgot to remove, an
+insecure registry, an obviously dangerous `eval()` call — nobody on the other end of
+those is trying to hide from a scanner. A specifically motivated attacker who knows
+how static, signature-based detection works can evade individual signals like entropy
+thresholds without much effort. Treat GitGalaxy as the fast first pass across a
+codebase too large to read by hand — not the last word on whether something is safe.
+
+</div>
+
+### Weakness Classes, Not Just Known CVEs
+
+Most dependency scanners work from a lookup table: they know a vulnerability exists
+because someone found it, filed it, and it now has a CVE number in a feed. That's
+useful, but it's necessarily reactive — a scanner built this way is blind to anything
+that hasn't been discovered and disclosed yet, including straightforward variants of
+known-bad patterns that just look slightly different from the filed instance.
+
+GitGalaxy takes a different approach: instead of matching known instances, it matches
+weakness *classes*. Its findings are tagged by CWE (Common Weakness Enumeration) —
+hardcoded credentials, dynamic code execution, unsafe deserialization — not by CVE ID.
+A structural signature for "dynamic execution of tainted input" catches that pattern
+wherever it appears, with whatever variable names, in whatever specific arrangement —
+not just the one instance someone already filed a report about.
+
+The same philosophy extends to the SBOM layer. Rather than asking "does this package
+version appear in a vulnerability database," GitGalaxy's zero-trust physical audit
+asks "does this package's actual content on disk structurally match what a legitimate
+version should look like" — entropy, structural fingerprint, behavioral anomaly flags.
+That's how a tampered dependency gets caught on day one, before anyone has discovered
+or disclosed anything, because there's no CVE to wait for.
+
+This is a complement to CVE-feed tools (Snyk, Dependabot, OSV-Scanner), not a
+replacement for them — those tools are the right answer for "is this exact known bug
+present." GitGalaxy is the right answer for the wider net: weakness classes and
+physical anomalies that don't require anyone to have found and filed the specific
+instance first.
+
+### Real-World Adoption
+
+<div align="center">
+
+Tracking the total, deduplicated volume of fetches across PyPI, GitHub, and GitLab against our baseline control repositories.
+
+<img src="https://raw.githubusercontent.com/squid-protocol/squid-telemetry/main/cumulative_downloads.png" alt="GitGalaxy Cumulative Downloads" width="500">
+
+Measured without mirrors. The GitHub/PyPI breakdown lines begin partway through the window because per-source tracking was added after total-fetch tracking; the total line before that point is aggregate across all sources.
+</div>
+
+<div>
+
+## Benchmarks
+* **[50+ Language Test Repo](https://github.com/squid-protocol/language-crucible)** and [artifacts](https://github.com/squid-protocol/language-crucible/tree/main/raw_output)
+* **[Speed Results from 104 Repos](https://squid-protocol.github.io/gitgalaxy/03-01-claim-1-search-strategies/)**
+* **[Cross-Language Comparisons of over 1000 repos](https://squid-protocol.github.io/gitgalaxy/03-04-claim-4-comparing-languages/):** Deterministic 1:1 benchmarking of distinct syntax architectures.
+* **[Universal File Archetypes by k-means clustering](https://squid-protocol.github.io/gitgalaxy/03-05-claim-5-file-archetypes/):** ML isolation of files into K-means clusters.
+* **[Mainframe Proven: 100% CI/CD Translation Success Rate](https://github.com/squid-protocol/gitgalaxy/tree/main/examples/ibm_cics_translation):** 27 out of 27 successful architectural translation of 27 distinct legacy COBOL repositories (including IBM CICS benchmark apps) into compiling Java Spring Boot environments.
+
+</div>
+
+<div>
+
+## Data Privacy & On-Premise Deployment
+* 100% air-gapped execution
+* On-premise deployment
+* Zero-trust processing model
+</div>
+
+<div>
+
+## Installation & Usage
+* Python-based: `pip install gitgalaxy`
+* CLI execution
+* **[How to add a new programming language in 1 prompt](https://github.com/squid-protocol/gitgalaxy/blob/main/gitgalaxy/standards/how_to_add_a_language.md)**
+* Outputs forensic JSONs (optimized for AI-agent summary reports) and a native SQLite3 database for robust querying and storage.
+
+### CI/CD Integration
+
+Drop the template for your platform straight into your pipeline — each one runs a GitGalaxy scan and can fail the build on risk-threshold or malware-signature breaches.
+
+| Platform | Template |
+|---|---|
+| **GitHub Actions** | [`gitgalaxy-pipeline.yml`](https://github.com/squid-protocol/gitgalaxy/blob/main/templates/github/gitgalaxy-pipeline.yml) — see the [full integration guide](https://github.com/squid-protocol/gitgalaxy/blob/main/github-action-readme.md) |
+| **GitLab CI** | [`scan.yml`](https://github.com/squid-protocol/gitgalaxy/blob/main/templates/gitlab/scan.yml) |
+| **Bitbucket Pipelines** | [`bitbucket-pipelines.yml`](https://github.com/squid-protocol/gitgalaxy/blob/main/templates/bitbucket/bitbucket-pipelines.yml) + [`bitbucket_insights.py`](https://github.com/squid-protocol/gitgalaxy/blob/main/templates/bitbucket/bitbucket_insights.py) (posts findings as Bitbucket Code Insights annotations) |
+| **Azure Pipelines** | [`azure-pipelines.yml`](https://github.com/squid-protocol/gitgalaxy/blob/main/templates/azure/azure-pipelines.yml) |
+| **Anything else** (Jenkins, CircleCI, etc.) | [`scan.yml`](https://github.com/squid-protocol/gitgalaxy/blob/main/templates/scan.yml) — generic, shell-invocable template |
+
+</div>
+
+
+
+## Enterprise Codebase Tools & Use Cases
+
+GitGalaxy operates on a Decoupled Architecture. While the core engine provides the overarching structural mechanics and topological mapping, our specialized Decoupled Execution Controllers leverage that deterministic graph to execute enterprise-grade operations.
+
+### [Automated Legacy Migration: COBOL to Java Spring Boot](https://github.com/squid-protocol/gitgalaxy/tree/main/gitgalaxy/tools/cobol_to_java/)
+A deterministic, high-fidelity translation pipeline. It converts legacy COBOL into fully compiling, modern Spring Boot architectures, mapping memory exactly and scaffolding JPA entities, REST controllers, and Maven builds before utilizing AI to translate isolated business logic.
+* **Proven Metric:** Achieved a perfect 27/27 Maven compile success rate across a batch test of distinct legacy repos.
+* **Verify for Yourself:** [Inspect the raw outputs of the IBM CICS Application Translation here.](https://github.com/squid-protocol/gitgalaxy/tree/main/examples/ibm_cics_translation/)
+
+### [Mainframe Refactoring: COBOL & JCL Optimization](https://github.com/squid-protocol/gitgalaxy/tree/main/gitgalaxy/tools/cobol_to_cobol/)
+An analytical suite for sanitizing mainframe monoliths. It safely neutralizes legacy lexical traps, extracts dead execution memory, maps topological DAG execution orders, and generates Zero-Trust JCL configurations for modern cloud deployments.
+* **Proven Metric:** The dead-code extraction engine removed over 6,700 lines of dead execution blocks and orphaned variables from the standard IBM CICS benchmark app in seconds.
+
+### [Software Supply Chain Security & Pre-Commit Firewalls](https://github.com/squid-protocol/gitgalaxy/tree/main/gitgalaxy/tools/supply_chain_security/)
+Extreme-velocity pre-commit firewalls. Instead of trusting manifest files, it scans physical internals to block steganography, byte-level XOR decryption loops, homoglyph typosquatting, and exposed cryptographic vaults before they ever enter your CI/CD pipeline. **[Deploy directly via our GitHub Action](https://github.com/squid-protocol/gitgalaxy/blob/main/github-action-readme.md).**
+
+### [Zero-Trust SBOM Generation & Dependency Auditing](https://github.com/squid-protocol/gitgalaxy/tree/main/gitgalaxy/tools/compliance/)
+A Zero-Trust Software Bill of Materials (SBOM) generator. It refuses to blindly trust `package.json` or `requirements.txt` files, instead locating the physical dependencies on disk, mathematically verifying their entropy and linguistic identity, and generating strict CycloneDX 1.4 JSON reports.
+* **Proven Metric:** Successfully mapped and mathematically verified the physical internals of 170 unique Go modules inside the local Kubernetes repository.
+
+### [API Security & Shadow API Detection](https://github.com/squid-protocol/gitgalaxy/tree/main/gitgalaxy/tools/network_auditing/)
+A deterministic mapping tool that hunts undocumented vulnerabilities. It uses structural regex to find active physical routing logic (Express, Spring Boot, FastAPI) and applies set theory against official OpenAPI/Swagger documentation to isolate critical Shadow APIs and outdated Ghost APIs.
+
+### [High-Speed PII Detection & Log Analysis](https://github.com/squid-protocol/gitgalaxy/tree/main/gitgalaxy/tools/terabyte_log_scanning/)
+Unindexed, tactical log analysis operating at 0.07 GB/sec. It streams massive database dumps to deterministically hunt and mask PII (Credit Cards, SSNs, AWS Keys) and uses static architecture maps to prove exact runtime execution frequencies with ASCII time-series histograms.
+
+### [AI Agent Guardrails & Codebase Protection](https://github.com/squid-protocol/gitgalaxy/tree/main/gitgalaxy/tools/ai_guardrails/)
+Specialized keyword sensors protecting both your application and your codebase. The AppSec Sensor detects weaponized LLM features (RCE funnels, exfiltration risks), while the Dev Agent Firewall evaluates token mass and blast radius to restrict autonomous coding agents from modifying dangerous or context-token-draining files. Helps identify which files need to be chunked to reduce context overload.
+
+## Local Browser-Based 3D Codebase Visualization
+
+If you prefer visual analytics, we've built a topological dashboard where each file represents a node, sized and colored according to specific risk metrics.
+
+Simply drag and drop your generated `your_repo_GPU_galaxy.json` file (or a `.zip` of your raw repository) directly into [GitGalaxy.io](https://gitgalaxy.io/). All rendering and scanning happens entirely in your browser's local memory.
+
+### 🔭 Watch GitGalaxy in Action
+
+**Mapping 3.2 Million Lines of C++ in 11 Seconds | OpenCV** [![OpenCV Demo](https://img.youtube.com/vi/3ScQCSUBdZw/maxresdefault.jpg)](https://youtu.be/3ScQCSUBdZw)
+
+![GitGalaxy Topological Visualizer 3D graph rendering complex software repository structures and K-means clustering archetypes in the browser](https://raw.githubusercontent.com/squid-protocol/gitgalaxy/main/docs/wiki/assets/metavisualizer.png)
+
+## Zero-Trust Data Security
+
+Your code never leaves your machine. GitGalaxy performs 100% of its scanning and vectorization locally.
+
+* **No Data Transmission:** Source code is never transmitted to any API, cloud database, or third-party service.
+* **Ephemeral Memory Processing:** Repositories are unpacked into a volatile memory buffer (RAM) and are automatically purged when the browser tab is closed.
+* **Privacy-by-Design:** Even when using the web-based viewer, the data remains behind the user's firewall at all times.
+
+## ⚖️ Licensing & Usage
+
+Copyright (c) 2026 Joe Esquibel
+
+GitGalaxy is distributed under the **PolyForm Noncommercial License 1.0.0**. 
+
+### 🎓 Community Free Tier (Academic, Research, & Hobbyist)
+We are deeply committed to the open-source and academic communities. If you are using GitGalaxy for personal projects, academic research, or non-commercial development, the engine is 100% free to use.
+
+To suppress the commercial licensing delays in your terminal or personal CI/CD pipelines, simply set the following environment variable:
+
+```bash
+export GITGALAXY_LICENSE_KEY="COMMUNITY_FREE_TIER"
+```
+
+### 🏢 Commercial & Enterprise Use
+Running GitGalaxy in corporate environments, proprietary codebases, or commercial CI/CD pipelines requires an enterprise license. Unlicensed corporate pipelines will experience intentional execution friction, and attempting to use the Community Free Tier key in a corporate environment will trigger explicit non-compliance warnings in your audit logs.
+
+To acquire a zero-trust commercial key for your organization and ensure clean compliance logs, please contact: **joe@gitgalaxy.io**