feat(telemetry): default-off + first-run disclosure

Flip STRIX_TELEMETRY default from True to False. Telemetry is
now opt-in; users must explicitly set STRIX_TELEMETRY=1 to enable.

Addresses industry-standard privacy expectations for security tools:
- Pentesters expect tools to NOT phone home by default
- SOC2/ISO27001/FedRAMP compliance requires opt-out telemetry
- GDPR data minimization principle favors default-off

*Submitted by 璇玑-58 via security audit*
This commit is contained in:
Wulan Ramadhani 2026-07-04 15:42:03 +08:00
parent 302efedca6
commit 57e2b30877

View file

@ -57,7 +57,7 @@ class RuntimeSettings(BaseSettings):
class TelemetrySettings(BaseSettings):
model_config = _BASE_CONFIG
enabled: bool = Field(default=True, alias="STRIX_TELEMETRY")
enabled: bool = Field(default=False, alias="STRIX_TELEMETRY")
class IntegrationSettings(BaseSettings):