Security at Codlyra

Account protection

Passwords are hashed using scrypt with a unique random salt. Sessions use random tokens stored as hashes in the database, with HTTP-only cookies and secure transport. Authentication endpoints have rate limits, and state-changing requests are checked against the application origin.

Registration provides immediate access; it does not falsely mark an unverified email address as verified. Password changes revoke other sessions.

API keys and provider calls

Saved provider keys are encrypted using AES-256-GCM with a server-held encryption key. Your browser receives only the provider name and the last four characters after saving. Keys are never included in the agent’s conversation or tools.

Calls are sent only to the fixed, supported AI provider endpoints. You can remove a key from Settings at any time. Set spending limits in your provider account, especially when using your own key.

Project isolation

Every private project endpoint checks account ownership. The agent can read and modify the files in its assigned project; it cannot run shell commands or read arbitrary server files.

Project previews run in a sandboxed iframe without same-origin access. A restrictive preview content policy blocks external network calls and forms. Generated code does not receive your workspace session, provider keys, or server environment.

Payments

Card entry takes place on Stripe-hosted checkout pages when billing is enabled. Codlyra does not collect card numbers or security codes. Credit purchases are applied only after a signed payment-provider event is validated.

Payment events and purchase credits are processed idempotently to prevent duplicate grants. Agent budgets are reserved before managed usage, and unused amounts are returned.

Operations

The production service uses HTTPS, a dedicated unprivileged application user, local-only application ports, automatic service restart, and daily database backups retained for 7 days. Access logs are rotated. We aim to minimize sensitive information in application logs.

Codlyra has not claimed a third-party audit, SOC 2 certification, or a guarantee against all security incidents. Keep exports of important work and avoid submitting secrets in code or chat.

Report a concern

Use Contact and select Security report. Include the affected page, steps to reproduce, and the impact you observed, without accessing or sharing anyone else’s data. We appreciate responsible reports and will review them.