Build tool privacy ratings
JavaScript bundlers and build tools.
9 bundlers and build tools are rated against 4 public criteria, and 9 have enough evidence for a letter grade. Of the 2 with a known jurisdiction, 2 are based in a Five Eyes country, and 2 in the wider Fourteen Eyes.
Open-source bundlers and build tools only · Criteria for this category · Suggest an addition · Markdown
| Name | Grade | Score | Data | Jurisdiction | Open source | No trackers or telemetry | No ads or data sales | Independent audit |
|---|---|---|---|---|---|---|---|---|
JavaScript and TypeScript bundler and minifier written in Go, with a command-line tool and APIs for JavaScript and Go. |
Grade B | 80 | 100% | – | Yes | Yes | Yes | No |
JavaScript and TypeScript bundler written in Rust with a Rollup-compatible API, developed as the bundler for Vite. |
Grade B | 80 | 100% | – | Yes | Yes | Yes | No |
Module bundler for JavaScript that compiles ES modules into bundles for libraries and applications, with tree shaking and a plugin API. |
Grade B | 80 | 100% | – | Yes | Yes | Yes | No |
Frontend build tool with a fast development server using native ES modules and hot module replacement, and a production bundler for web applications. |
Grade B | 80 | 100% | – | Yes | Yes | Yes | No |
JavaScript runtime, package manager, test runner and bundler in a single executable, built on JavaScriptCore and written in Zig. |
Grade C | 65 | 100% | United States Five Eyes | Yes | Partial | Yes | No |
Zero-configuration bundler for web applications that builds JavaScript, CSS, HTML and other assets, with a Rust-based compiler and built-in development server. |
Grade D | 50 | 100% | – | Yes | No | Yes | No |
JavaScript bundler written in Rust that is compatible with the webpack configuration and plugin API, developed by the ByteDance web infrastructure team. |
Grade D | 50 | 100% | – | Yes | No | Yes | No |
Module bundler for JavaScript applications that builds a dependency graph and packages code and assets into bundles, extensible through loaders and plugins. |
Grade D | 50 | 100% | – | Yes | No | Yes | No |
Incremental bundler written in Rust and built into Next.js, used by the Next.js development server and production builds. |
Grade D | 40 | 100% | United States Five Eyes | Yes | No | Partial | No |
Questions
What is the most private option among bundlers and build tools?
No pick has been made yet. The table above is sorted by score, based on public evidence.
How are bundlers and build tools rated?
Each entry answers 4 questions: open source, no trackers or telemetry, no ads or data sales and independent audit. Answers need links to evidence. See the full criteria.
Does jurisdiction matter?
Jurisdiction decides which laws can compel a provider to hand over data. Each entry shows its country and whether it is in the Five, Nine or Fourteen Eyes. The data a provider can hand over depends mostly on what it stores and who holds the keys. Read about jurisdictions and the CLOUD Act.