Security

Commands and code changes stay visible before execution whenever possible. Shell commands are shown before they run. File writes require approval.

Authentication tokens stay on your machine. Environment files and common secret paths are excluded from context by default.

All traffic uses TLS. Server-side data is encrypted at rest. Access to production systems is limited and logged.

Email [email protected] with steps to reproduce and any impact you observed.

We acknowledge reports within two business days and aim to give a remediation timeline within ten. Please do not test against other people's data.

We prefer coordinated disclosure. Give us a reasonable window to ship a fix, and we will credit you if you want the credit.