Local and public-repository scans share one counting engine but have different trust and capacity boundaries. A local selection grants the browser temporary read access to explicit files. Public GitHub mode sends the repository identifier to GitHub, resolves the default branch to one commit, reads a recursive tree, and streams raw public files from GitHub. Neither mode sends source to SympifyApps.
Use local mode for private or very large work
Select only the project or files you intend to inspect. SourceTally streams one local file at a time and discards decoded text after updating aggregates. It does not persist paths or reports. Browser file selection still has device and browser limits, so the app rejects more than 100,000 entries and reports files larger than the documented per-file boundary instead of silently truncating them.
Public GitHub mode is pinned but bounded
The repository metadata and tree use GitHub’s unauthenticated REST allowance. Raw content is requested at the resolved commit, so one run does not mix moving branch revisions. GitHub may rate-limit requests or truncate recursive trees above its documented boundary. SourceTally stops and asks for a local checkout when the tree is truncated or the safe remote file/byte limits are exceeded.
Review exclusions before every decision
Dependencies, build directories, caches, minified bundles, source maps, known binaries, and oversize files are excluded or skipped by default. That usually makes application source easier to see, but it may remove vendored code or generated interfaces that matter to your question. Toggle only deliberate categories and record the choice beside any exported aggregate report.
A line counter is not a security scanner
Local processing reduces one transfer risk; it does not prove the selected project is safe, licensed, secret-free, trustworthy, or authorized. SourceTally never searches for credentials and never accepts a GitHub token. Follow your organization’s handling rules, avoid opening unknown sensitive folders, and use dedicated reviewed tools for secrets, malware, licences, vulnerabilities, and compliance.