Security

Every file edit the agent proposes is shown to you as a diff before it is written. You accept or reject each change individually. The agent cannot commit, push, or deploy without your explicit approval.

In Explore and Plan modes, the agent operates read-only — it cannot modify files at all. In Build and Debug modes, edits are queued for your review.

Commands the agent runs are confined to your project directory by an OS-level sandbox. On macOS this uses Seatbelt, on Linux it uses Landlock, and on Windows it runs the command under a Low integrity token. Projects kept inside WSL run their commands inside the distro, confined by Landlock there.

The sandbox enforces write confinement — the agent can read files it needs for context, but writes are restricted to the workspace you opened, temporary directories, and the toolchain caches package managers need (npm, pnpm, yarn, Cargo, Go). It cannot write to your system files, your wider home directory, or other projects. When a toolchain legitimately needs to write somewhere else, Atlarix asks once, grants that exact path, and re-runs the command still confined.

Commands that could cause damage (deleting branches, force-pushing, modifying system configuration) trigger a separate confirmation gate, even when the sandbox would otherwise allow them.

Atlarix Core (default): Unless you set up your own models, Atlarix runs on Atlarix Core. Your request passes through our authenticated proxy, which verifies your account before anything is sent — we don't log or retain the request. From there it goes directly to the model provider that serves it, who processes it under their own data policy. We don't have zero-retention agreements with these providers, so we can't guarantee what they keep. See our Models page for how models are connected in Atlarix.

Local models (you set up): Run a local model — for example through Ollama — and your code and prompts never leave your machine. Nothing is sent, stored, or logged — by us or anyone.

Your own API key (you set up): Add your own provider key and requests go directly to the provider you chose. Atlarix acts as a local client — we never see the traffic.

• Analytics — opt-in PostHog telemetry (feature usage, session data). You choose on first launch and can change it anytime in Settings.
• Error reports — Sentry crash reports (stack traces, device info). No code content is included.
• Account data — email, name, subscription tier, stored in Supabase.
• Payments — handled by LemonSqueezy. Atlarix never sees your card details.

We do not store your code on our servers. We do not train on your code.

macOS: Atlarix builds are code-signed and notarized by Apple. macOS trusts them out of the box — no Gatekeeper warnings.

Windows: The Microsoft Store build is signed by Microsoft and installs with no warning. The direct .exe and .msi downloads are not yet code-signed, so Windows Defender shows a SmartScreen warning on first install. Code signing for the direct downloads is on the roadmap.

Linux: Builds ship as .deb, .rpm, and .AppImage with SHA256 checksums for download integrity verification.

If you find a security issue, please report it to security@atlarix.dev. We will acknowledge your report within 48 hours and provide a timeline for a fix.

We do not currently run a paid bug bounty program, but we credit reporters in the changelog when they consent.