Explicit access.
Visible boundaries.

Keep the control origin local.

The default installation exposes http://127.0.0.1:8080. The API, PostgreSQL and runtime scanner have no host-published ports. Exact Host and Origin checks protect the control boundary; browser mutations also require a session-bound CSRF value.

Editor capabilities belong to an exact profile, origin and authority generation. Browser and editor membership can be revoked independently. Installation secrets stay outside the checkout in owner-private runtime state.

Local account owners, OS administrators and the Docker engine remain trusted. Do not expose the control origin to a LAN or public network to work around a connection problem.

Authorize the repository you mean.

Selecting a repository in the editor is separate from granting source access. POSIX and Remote WSL sources use read-only mounts; supported native Windows source uses bounded, sealed snapshots. Unsafe links, changed identities and incomplete captures are refused.

Findings and bounded snippets are redacted before local persistence. Raw tool output is temporary and deleted after processing. Redaction recognizes known patterns and cannot guarantee that every secret is removed.

Do not grant access when retaining even redacted findings or snippets is unacceptable. Restricted scanner processes do not make arbitrary repository content safe to execute.

Complete evidence has a meaning.

Runtime scanners use validated, read-only cache data and an internal network. A separate updater reaches reviewed sources without a project-source mount. Cache activation checks content, digests, compatibility and freshness.

Failed, partial, cancelled, stale or missing evidence cannot authorize a protected push. Changing a finding's lifecycle or a gate threshold does not repair incomplete coverage. Local Git hooks remain bypassable.

Bundled definitions expire. Updates require refreshed reviewed source, rebuilding changed inputs and explicit preparation. The preview does not promise a signed automatic update channel.

A remote request needs a deliberate choice.

Ordinary scans do not invoke AI. Advisor can use local Ollama or an explicitly authorized remote Ollama endpoint. Remote use requires host and endpoint authorization, model identity and a fresh single-finding disclosure confirmation.

Automatic and bulk remote routing are not allowed. Cancellation cannot recall content a remote provider has already received. Advisor output is untrusted advice and never determines the gate.