Bundler audit is entirely local; you install it as a gem, and it fetches a fresh copy of the database on its own. Regarding Gemcanary, we're actually in the mi

Bundler audit is entirely local; you install it as a gem, and it fetches a fresh copy of the database on its own. Regarding Gemcanary, we're actually in the midst of building something just like that because we deeply hate storing Github tokens - but the ease of use was too good to not go for with our proof of concept. Once we release the new feature it'll be our goal to move as many people as possible away from giving us access to their private github repos.