Security
Practices below cover the planned Windows application and, where noted, website account authentication. This site does not process desktop project data or payments.
Sign-in uses Supabase Auth with PKCE. Passwords are handled by Supabase, not stored in application tables. OAuth (Google/GitHub) uses provider redirects through Supabase. Session tokens are kept in the browser. Row Level Security applies to user profile tables in the database. Billing and desktop licence checks are not enabled yet.
API keys and tokens are stored in the operating system’s secure storage on the local machine. They are never written into source, prompts, logs, activity feeds, artifacts or exports. Redaction runs before anything is displayed or written to disk.
MCP servers, providers and the terminal have explicit permission scopes (read, write, network, execute). Destructive file, Git or command actions require confirmation. Path access is validated against the open project folder.
Desktop project data is specified to live in the project folder you choose. This website does not collect project files or AI prompts. Website accounts use Supabase Auth and store only account-related profile data needed for sign-in; they are not a substitute for local project storage.
Security, privacy, accessibility, dependency and documentation findings carry an ID, severity, evidence, recommendation and links to the component and requirement they affect. Colour is never the only indicator of status.
When an agent calls a model, only the structured context you configured is sent. Classification on data-flow edges (public, internal, personal, credential) is what the Security Agent checks before a prompt is built.
Windows installers will be code-signed. Each build will publish a SHA-256 checksum and release notes on the Download page. This website does not host placeholder binaries.
Report a vulnerability
Related: Privacy, agents and providers, download verification.