Security, privacy and safety
Designed to be boring about your source code.
These are commitments from the product specification, written down so they can be checked against the shipped alpha rather than taken on trust.
Local by default
The graph, QA plans, runs, evidence and reports live in a .appvecta/ folder in the workspace. There is no Appvecta server in the first release.
- config.json and deliberately authored QA flows are safe to commit.
- Caches, the graph database, evidence and reports are git-ignored by default.
- Secrets never go in files — they use the OS credential store.
Indexing never executes repository code
Building the Brain reads files. It never runs Gradle, Flutter or a project script. Only Run, Build and Test execute build logic, and the interface says so first.
- This is enforced by an automated test that asserts zero build executions during indexing.
Execution rules, enforced in code
Not documented conventions — constraints in the engine.
- Arguments are arrays and never a shell string built from model output.
- Working directories are scoped to the workspace.
- The child environment is an allowlist.
- Every execution has a timeout and a cancellation token that kills the process tree.
- Everything is written to an audit trail with category, redacted arguments, exit code, duration, touched files and initiator.
Secrets
Provider keys and test credentials use the editor's SecretStorage, which is your OS keychain.
- Blocked by default: .env*, *.jks, *.keystore, *.p12, *.pem, local.properties, key.properties, secrets*.xml
- A redaction pipeline covers agent context, logs, audit entries, reports and diagnostic bundles.
- QA steps can be marked sensitive to skip screenshots.
Untrusted repositories
Repository text — code, comments, README, build scripts, QA plans found in the repo — is treated as data, never as instructions.
- The tool allowlist does not depend on what a model or a repository asks for.
- A hostile test fixture with prompt-injection comments and a malicious Gradle task is part of the test suite.
Change safety
Every write is bounded, reviewable and reversible.
- Multi-file edits require approval.
- Patches are validated for path boundary, secret-file blocklist, binary content and conflicts before being applied.
- Every task has a checkpoint.
- Appvecta never runs git reset, git checkout -- ., git clean or stash operations. The only Git commands available to the agent are diff, status, log and show.
Privacy
The provider setup screen shows exactly what leaves the machine: source ranges, Brain facts, report excerpts, device metadata.
- Per-provider exclusion rules are supported.
- A "Preview context" action shows the actual payload before sending.
- The alpha ships with no telemetry and no crash reporting.
- Diagnostic bundles are user-initiated, redacted, and previewed before export.
Command categories
Every command the engine can run falls into one of five categories, each with its own default.
| Category | Examples | Default |
|---|---|---|
| read-only | adb devices, getprop, file reads | automatic |
| build-test | Gradle assemble/test, flutter build, adb install, am start | automatic after Workspace Trust |
| file-write | patch apply, config write, QA plan save | automatic for one file; asks for multi-file |
| network | provider calls, driver download, dependency installs | asks |
| destructive | pm clear, uninstall, AVD delete, dependency changes, migrations, signing | always askscannot be auto-approved |