Visible boundaries around sensitive actions.

Accounts and sessions

Passwords are hashed with bcrypt. Web sessions are signed, IDE sessions are stored as hashes and can be revoked from the profile. A ban invalidates web, IDE and API access.

Protection of the free plan combines a pseudonymised device fingerprint with the network address observed by the server. No detailed hardware inventory or raw system identifier is sent. A device conflict rejects the second free quota without automatically banning the accounts.

API keys

An ACLIDE key begins with aclide_sk_ and is shown in plain text only once. Only its SHA-256 hash, prefix and last four characters are retained. A revoked key cannot be reactivated.

Agent actions

Dangerous operations must request visible confirmation: running commands, recursive deletion, access outside the workspace, reading a known secret or making extensive changes. The user retains the final decision.

Minimised logs

Usage logs record metadata required for quota management and diagnosis: model, tokens, credits, latency and status. They do not record the prompt, response, authentication token or a sensitive header.

Report a vulnerability

Send a reproducible description to [email protected]. Do not access a third party’s data, disrupt the service or disclose the vulnerability before a fix can be prepared.

State the affected surface, steps, observed impact and a way to contact you. No password, private key or real user data should accompany the report.