FAQ for authors

What permissions does the GitHub App ask for?

Contents: Read-only and Metadata: Read-only on the repositories you select. Not full repo scope. Not write access.

Why must I fill a term list?

Hido only replaces strings you list. It does not invent identity terms. An empty list is rejected — publishing under an “anonymous” label with zero masking is the failure mode we refuse to ship.

What should I put in the list?

• Name variants (full name, common romanizations, initials used in paths)
• Institution and lab names, email local parts and domains
• GitHub org / username, project codenames in paths
• Personal domains and known absolute home-directory fragments

Use the dry-run report: zero hits usually means a misspelling; huge hit counts usually means a stop-word.

Do you track reviewers?

No. The reader origin has no cookies and no analytics. We will not add “who viewed my code”.

Can reviewers run my HTML demo in the browser?

No webview. Reviewers read code as text, download zip, or git clone. Executing author HTML is a deanonymization channel.

Submodules?

Not recursed. Only .gitmodules text is rewritten. Flatten submodule content into the parent repo if reviewers need it.

Size and rate limits

• Single file: 50 MiB
• Tracked files per repository: 20 000
• Total repository size: 500 MiB
• Repositories per account: 50 (including deleted tombstones)
• Concurrent ingest jobs per account: 3
• Dry-runs per account per 24h: 100
• Global queue depth before refuse: 200 jobs

Exact numbers also appear in the console after sign-in and at GET /api/limits.

How long does a link live?

About 120 days after each successful publish (refreshed when you Update). Delete removes objects and the source binding permanently; expiry closes the link but keeps the binding so you can Update the same URL later.