Security
Security
Reporting a vulnerability
Found an issue? Email security@technicallynot.ai before disclosing it publicly, so we can fix it first.
We answer a report within 5 business days, and we ask for 90 days to fix the problem before it is made public. You can also report it privately on GitHub: open a private report.
How it's built
- Runs locally. Your code and project files never go to our servers.
- No telemetry. The app sends no analytics, usage statistics or crash reports, to us or to anyone else. The few requests it does make (an update check, version checks for your agent programs, your own Claude usage numbers from Anthropic, the speech model's download), and what you can switch on yourself, are listed with their files under What leaves your computer.
- No stored passwords or sign-in tokens. Each agent CLI signs in itself.
- API keys stay on your computer. Add your own Claude Code or Codex API key and it's kept encrypted by your operating system's secure store, never sent to our server. An agent running on that key can read it, the same as any tool run on an API key.
- Folder-trust questions. Folder-trust questions from your agent CLI show up as Needs you.
- Open source. The app’s code is public under the MIT licence, so anyone can check these points. Read the source code.
Updates
Installed copies look for updates on GitHub, in the releases of the app’s public source code, and offer them in the app; you choose when to install. The update shows what is new in the app before you install it.
Code signing
Installers aren't code-signed yet, so Windows may warn before you run one.