Security
Current safeguards and the responsibilities that remain yours.
Account-scoped access
Workspace requests require a signed-in account. Project operations check ownership, and access policies separate user records.
Public publishing
Public site reads use a restricted publishing function that returns the latest version only for public projects. Anonymous visitors do not receive direct access to workspace tables.
Execution boundaries
Commands require an explicit Run action. Runs use isolated, temporary execution environments with bounded commands and output, without app secrets or internet access.
Generated-code checks
Generated HTML and inline JavaScript receive static checks before saving. Automatic repair passes depend on permission mode. These are not penetration tests, runtime tests or a guarantee that generated apps are secure.
Protect sensitive information
Never put private credentials in prompts, attachments, generated frontend code or public pages. Review code before publishing or connecting it to real customer data.
Report a vulnerability
A verified security-reporting contact has not yet been published. Do not post credentials or exploit details in public projects. No certification, audit badge or bug-bounty promise is claimed here.