# Footprint

> Cloak Watch's Footprint tab lists the repositories, domains, servers, clusters, cloud accounts and registries your Mac's config files name, read without contacting any of them.

Source: https://docs.subcloak.com/cloak-watch/footprint/

Added in Cloak Watch 1.2.0.

A stolen laptop key reaches more than the laptop: the repositories you push to, the servers you SSH into, the clusters and cloud accounts your configs name. **Footprint**, a tab in [Inventory](https://docs.subcloak.com/cloak-watch/inventory/), lists them, so after an incident you know what else to check and which keys to rotate. Watch reads names only, from config files, never a token or password, and it contacts none of them.

*[Screenshot: Inventory › Footprint: a table of repositories, domains, servers, clusters, cloud accounts and registries with Name, Type, Provider, Found in and Where columns, and the repository ada-park/shopapp selected, with Beyond this Mac saying checking it on GitHub is coming soon]*

## What it lists

Columns: **Name**, **Type**, **Provider**, **Found in**, **Where**.

| Type | Where Watch looks |
|---|---|
| **Repository** | Git remotes in `.git/config` in your code folders: GitHub, GitLab, Bitbucket, Codeberg and Azure DevOps. A user name or token in a remote URL is dropped (and still flagged by [REPO-8](https://docs.subcloak.com/cloak-watch/detections/#repo-8)). |
| **Domain** | Cloudflare `wrangler.toml` and `wrangler.json` routes and zones, Fly.io `fly.toml` (`<app>.fly.dev`), and GitHub Pages `CNAME` files |
| **Server** | Hosts in `~/.ssh/config` and files it includes (never `ProxyCommand` or `Match exec`), `~/.ssh/known_hosts` (hashed lines can't be read), and remote Docker contexts |
| **Cluster** | Cluster names and API servers in your kubeconfig. The users section, with its tokens, is skipped. Local clusters aren't listed. |
| **Cloud account** | AWS account IDs and profiles in `~/.aws/config` (never `~/.aws/credentials`), Google Cloud projects, Azure subscriptions, Heroku apps, Cloudflare Workers, Fly.io apps, Vercel and Netlify projects, and Firebase projects |
| **Registry** | Private npm registries in `.npmrc`, Docker registries you're logged in to (host names only), and private Python indexes in `pip.conf` and `uv.toml` |

**Found in** says which file or setting named it, such as **git remote origin** or **ssh config**.

## What you can do from it

Select a row. The inspector's **Beyond this Mac** section says what Watch can do with it:

| Row | Inspector |
|---|---|
| A GitHub repository | Check it on GitHub, read-only, through [GitHub](https://docs.subcloak.com/cloak-watch/github/): **Connect GitHub…**, or **Show in GitHub** once connected. Until connecting GitHub is available, you can't connect from here; Watch keeps checking the workflows and lockfiles in the clone on this Mac. |
| A domain | **Check This Domain…** adds it to [Domains](https://docs.subcloak.com/cloak-watch/domains/), which checks its certificate and DNS once a day, or **Show in Domains** once it's added |
| Anything else | "Watch only lists it. It doesn't connect to servers, clusters or cloud accounts." |

> **Note:**
> Footprint is a list, not a check: it raises no cards. It reads files only; nothing is looked up or sent while it's built.

## From Terminal

`watchctl footprint` prints the same list, and `watchctl footprint --counts` a count by type and provider. See [watchctl footprint](https://docs.subcloak.com/cloak-watch/watchctl/#footprint).

## Related

  - [GitHub](https://docs.subcloak.com/cloak-watch/github/): Check your repositories and account, read-only.
  - [Domain checks](https://docs.subcloak.com/cloak-watch/domains/): Certificates, CAA and dangling CNAMEs.
  - [Respond to an incident](https://docs.subcloak.com/cloak-watch/respond/): Which keys to rotate, in order.