Your keys. Your host.

BYOK

Provider keys live on your install’s key page — not in a Chazakah cloud. Use local models, or connect cloud providers with credentials you own.

Isolation

App routes require a signed-in account. Sessions and workspaces stay scoped so one user’s context is not another’s.

Approvals

Computer (shell and browser) waits on an ask gate before acting. Safety limits are documented on Safety.

Advisories

When we publish a security advisory for OpenBot or the bridge, it will be listed here and linked from News. There are no open advisories at this time.

Report a vulnerability

Please report security issues privately via Contact. Include steps to reproduce, affected versions, and impact. We do not run a public bug-bounty program yet; responsible disclosure is still welcome. Do not file security reports in public GitHub issues.

Health checks can stay public. This page describes product posture, not a penetration-test report.