How CodeStilt keeps your code and your money safe
An AI agent that can change files must be held on a short leash. These are the rules CodeStilt follows, and how each one is enforced.
What the agent can and can't do on your computer
These rules are code inside the desktop app, not instructions to the AI. The AI never sees a switch it could change.
Never allowed
- Deleting or moving files with commands, formatting disks, changing permissions
- Starting a shell or running arbitrary code (bash, cmd, PowerShell, eval)
- Downloading or connecting elsewhere (curl, wget, ssh, scp)
- Running as administrator, changing system settings or services
git push, reset, clean, rebase and other history-changing Git commands- Reading secret files, or touching anything outside your allowed folders
Asks you first
- Database commands and migrations (psql, mysql, db:reset)
- Deploys and publishing (docker, kubectl, terraform, npm publish)
- Installing packages (npm install x, pip install x, go get)
- Any command it doesn't recognise as a test or build command
- Running tests after a task changed a file that controls them, such as
package.json - Running tests after new code goes online or reads keys and
.env
Runs without asking
- Writing the files listed in the plan you approved
- Known test commands:
npm test,pytest,go test,cargo test,dotnet test,mvn test,php artisan test - Known lint and build commands such as
npm run build - Commands you put on your own allow list in Settings
- Switch to Ask before every command to be asked for these too
The danger wall
Some actions are blocked by code that runs on your computer, outside the AI. The AI cannot switch it off, talk its way around it, or hide an action inside another command. Blocked by default:
- Deleting files or folders, emptying a folder, or overwriting a file with nothing
- Database commands that change or remove data
- Deploying, publishing packages, or pushing to your main branch
- Reading or changing secret files, keys, tokens and passwords
- Installing new packages or running downloaded scripts
- Touching anything outside the folders you allowed
When the agent needs one of these, it stops and asks you. You can allow that one action once. Every unlock is written in the task history and, on team plans, the audit log.
Secrets are never read
Files such as .env, *.pem, id_rsa, cloud credentials and everything in .ssh, .aws and .git are skipped before any content leaves your computer. Text inside normal files that looks like an API key, token or password is replaced with [hidden-1], [hidden-2] before sending, and the real values are put back on your computer when the file is written.
Where your code goes
Your project stays on your computer. For each task, only the parts of files that the task needs are sent to the AI model through our servers, over an encrypted connection. We do not store your source code after the task finishes, and it is not used to train AI models.
Accounts and devices
There are no CodeStilt passwords to steal: you sign in with Google, GitHub, or a code or link sent to your email. A code works only in the browser that asked for it, and stops working after 5 wrong tries. A new computer is linked only after you confirm it in your browser while signed in. Every linked computer is listed, and removing one stops its access key working immediately. You can sign out all devices from your account settings.
Mistakes and undo
Before every task, CodeStilt saves a checkpoint of the files it may touch. One click puts everything back exactly as it was. The agent may only change the files listed in the plan you approved. If it needs another file, it asks first.
Money
Your plan has a hard monthly cap. You are never charged above it unless you buy extra credits yourself. Payments are handled by our payment provider; we never see or store card numbers.
Our servers
All traffic uses HTTPS. Keys you add yourself, such as your own AI provider key, are encrypted on our server and only ever shown as their last few characters. Payment webhooks are checked with a signature before anything changes on your account. Every change to our code runs through automated safety and attack tests before release.
We do not hold SOC 2 or ISO 27001 certificates today. We will only show them once an auditor has actually granted them.
Report a security problem
Email security@codestilt.com. We reply within 48 hours, keep you updated until it is fixed, and thank every valid report publicly if you want us to. Please give us a reasonable time to fix a problem before sharing it. Our security.txt has the details.
What is sent, and what is kept
| What it includes | |
|---|---|
| Sent for a task | File names in the allowed folder (up to 2,000), the content of files the task needs (2 MB per file by default), your rules and memories, the task text, and test output when tests fail. |
| Never sent | Secret files (.env, private keys, credentials.json, .npmrc, .netrc, Terraform state and more), everything in .ssh, .aws, .gnupg, .kube, .docker and .git, files outside allowed folders, and files you list yourself. |
| Hidden before sending | Values that look like API keys, tokens, passwords in connection strings and private keys become [hidden-1], [hidden-2] and are put back on your computer when the file is written. |
| Kept on our servers | Your account, settings, linked computers and folder names, task text, plans, progress messages, changed file names with line counts, and usage for billing. |
| Kept on your computer | Your access key, settings and task checkpoints. Checkpoints older than 7 days are deleted automatically. |
Start free. No card needed.
Download CodeStilt, link your computer, and give your first task in two minutes.