Security and privacy

Project files and provider requests

Your project files and runtime stay on the host by default. When you ask a coding provider to help, prompts and relevant project context may be sent to that provider under its own settings and terms. Local storage does not mean every AI request stays on your computer.

Review provider configuration before using sensitive projects. See the privacy policy for the service and connection disclosures.

Keep credentials out of client code

Put private service credentials in the host or application backend configuration that needs them. Browser and phone bundles are inspectable: a value with a public frontend prefix must be safe for anyone to read.

• Use only permissions needed by the integration.
• Keep private environment files out of Git.
• Redact keys, pairing codes, prompts, and personal paths from reports.
• Revoke or rotate a credential if it has been exposed.

Review tools and add-ons

A command proposed by an assistant can change files or run software. Read the requested action before approving it. Trusted local plugins execute code on the host and are not a sandbox: inspect their source and dependencies before installation.

Marketplace listing visibility does not grant installation or execution permission. Read plugin installation and device access before expanding either boundary.