Data handling and local files

DRE is a local command-line tool. It does not use product telemetry. This page summarises the files it can create on the machine or mounted filesystem where it runs, and the copies it can send to configured destinations. Keep the target path and DRE home directory on an encrypted disk, and never commit either one to a project repository.

Generated files

The target path holds generated project files. It is target/ in the project unless --target-path, DRE_TARGET_PATH or target_path: moves it. It can contain:

• Compiled SQL under target/compiled/. This includes report variables and other values rendered into the SQL. Secret environment variables are masked by default.
• Outputs under each run folder, such as workbooks, CSV, PDF and Parquet files built by DRE.
• Run records, including run_results.json and dre.log for each run. They record schedule, variable, output and delivery details. Secret values are masked by default.
• Project state, including target/manifest.json, schema snapshots and the current-run pointer. The manifest contains resolved project configuration, but not connection credentials.

Generated files are not encrypted by DRE. File permissions come from the operating system and the target directory. Use an encrypted volume or encrypted filesystem when reports contain personal, financial or other sensitive data.

DRE home directory

DRE keeps reusable state under ~/.dre:

• ~/.dre/plugins: downloaded plugin packages.
• ~/.dre/fonts: verified PDF fallback fonts.
• ~/.dre/oauth_sessions.json: renewable OAuth sessions some plugins keep between runs. On Unix, DRE creates this file with mode 0600, readable only by its owner.

DRE_PROFILES_DIR or --profiles-dir can keep profiles.yml inside ~/.dre or at another path. DRE reads that file but does not save long-lived credentials into oauth_sessions.json. Prefer env_var() references to a secrets manager or the runner’s secret store instead of plain-text credentials.

Delivery copies

DRE writes each output locally before a destination plugin delivers it. Email, SFTP, object storage, Slack and other destinations keep their own copies under their own retention rules. Cleaning the target path does not remove those remote copies.

Retention

Each run of a Binding gets its own folder. By default, DRE keeps only the latest run of each report and Set. keep_runs keeps more:

flags:
  keep_runs: 30

--keep-runs and DRE_KEEP_RUNS override it. The current run always stays. More retained runs preserve an audit trail, but also keep more generated reports and rows on disk.

Clean up

Prune old runs without deleting the current run or project state:

dre clean --prune --keep-runs 3

Delete the whole target path when its generated files and history are no longer needed:

dre clean

dre clean only deletes a directory DRE created or the project’s own target/. Review the resolved target path first when --target-path, DRE_TARGET_PATH or target_path: is in use. It does not remove delivered copies or ~/.dre.

Remove ~/.dre/plugins and ~/.dre/fonts only when you want to discard reusable downloads. The plugins and fonts can be installed again. Removing ~/.dre/oauth_sessions.json signs out the sessions saved by plugins; sign in again when a report needs one.

Repository and backup hygiene

• Keep target/ and any custom target path out of git. New projects ignore target/.
• Never commit profiles.yml when it contains credentials.
• Include compiled SQL, outputs and logs in your disk-encryption and backup policy if they contain sensitive report data.
• Treat a copied target directory as sensitive even when current log masking is enabled.