Collect diagnostics safely

Read this before pasting anything into a board, a ticket, or a chat. The feedback boards are public and third-party hosted.

What is safe and useful

• The TVO-AREA-NNN code — the single most useful thing, and it reveals nothing about your repository.
• tovio --version (the version flag; there is no tovio version subcommand).
• Your operating system and version.
• Which surface: CLI, VS Code, JetBrains, Desktop, SDK, MCP.
• A description of what you did and what happened.

What to strip

• File paths and repository names. Replace with <path>. Paths are metadata and often disclose more than the content would.
• Diffs and file contents.
• Tokens, keys, session strings, recovery phrases. Ever, on any channel.
• Identities, DIDs, hostnames, and other people’s data.
• The context block of a --json error. It is built for your eyes and routinely names paths, policy ids, identities, and attributes.

Getting just the code

Rather than pasting a whole error, pull out the one field that is safe to share:

tovio <command> --json

Report error.code and error.exit_code. Leave title, cause, and context out — all three quote your repository back at you.

The rule of thumb

Describe the behaviour rather than pasting the evidence. If you cannot describe the problem without pasting one of the above, treat it as potentially security-sensitive and use security@tovio.dev instead of a public board.

Local diagnosis

tovio healthtovio fscktovio access check <path>

Run these locally and report the conclusion, not the raw output. "fsck reports two corrupt objects" is a useful report; the output itself is not.