Security

Clodex is a desktop application rather than a hosted service. The blast radius of a compromise at our end is therefore considerably smaller than for a typical developer SaaS, because the valuable material never arrives at our end.

• Your source code remains on your disk.
• Your API keys and service credentials remain on your disk.
• Your prompts travel from your machine to your AI provider directly.

What our servers hold is your account record, the services you have linked, and counts of activity. Losing all of it would be embarrassing; it would not expose your code or your keys.

Stored locally

Service credentials and API keys reside in the application's settings file within your operating system's per-user application-data directory. They are read by the application and passed to processes it launches on your machine. They are never transmitted to Clodex servers; model-provider keys are expressly excluded from the synchronisation that reports connection status.

Session token

Your sign-in token is encrypted at rest using Electron's safeStorage, which delegates to the operating-system keystore — DPAPI on Windows, the Keychain on macOS. The stored file is self-describing, so an unencrypted token written by an older build is upgraded in place rather than left in the clear.

Provider logins

Claude Code and Codex maintain their own credentials in their own directories beneath your home folder. Clodex reads them only to determine whether you are signed in; it does not copy or relay them.

Billing

Card details are handled by Stripe and never reach our systems.

Every session runs in a mode you select, and the two agents expose their own. A Claude session offers five, mirroring those of Claude Code.

A Codex session uses that tool's own sandbox settings instead.

Bypass permissions and Full access carry hazard striping in the interface for good reason. They are the correct tool for a scratch directory and the wrong one for anything you would be troubled to lose.

Dictation could have shipped with a transcription API key embedded in the application, where anyone could extract it. Audio instead passes through a small broker service which exists specifically to keep that credential server-side.

• The transcription key exists only as a secret environment variable on the broker host.
• A client must present a valid Clodex session, which the broker verifies against the account API and checks for an active entitlement.
• On success it issues a five-minute, audio-only token. Your account credential is not stored.
• Per-user and per-IP limits cap concurrency, duration, request count and daily audio volume, so a stolen token cannot be used to run up a bill.
• Browser-origin requests are rejected, and clients cannot select arbitrary upstream endpoints or models.
• Upstream responses are normalised to an explicit field allowlist.
• Request URLs, credentials, audio, transcripts and upstream responses are not written to application logs. A refused request logs the reason, the plan and a truncated hash of the account, so that a rate-limit report can be explained without the log naming anyone.

The application checks a release feed on launch and periodically thereafter, downloads updates in the background, and installs them at the next restart. This is the mechanism by which security fixes reach you.

Releases are published on GitHub and downloaded over HTTPS from a single canonical source. Builds are not code-signed at present, so Windows reports an unknown publisher during installation and the updater has no publisher signature to check a downloaded installer against. Install Clodex only from useclodex.com or the official GitHub releases page. This section will describe signature verification once signing is enabled.

An honest security page must include the parts that are not solved.

• The agent executes real commands. In a permissive mode it can delete files, rewrite history and call any service you have connected. Nothing sandboxes it away from the directory you opened.
• Prompt injection is real. An agent that reads a file, a web page or a dependency's documentation can be influenced by text within it. Content in your project is untrusted input to a model that also holds your credentials.
• Connected services are live. A linked Stripe or Cloudflare account is a production account. The agent does not know which of your resources matter.
• Local storage is only as strong as your machine. Credentials at rest are protected by your operating-system user account. Malware already running as you can read them, as it could the configuration of any developer tool.
• AI output can be wrong or insecure. Generated code may contain vulnerabilities and requires review before it ships.

• Keep every project under version control, and commit before a large agent run.
• Use the least permissive mode that accomplishes the task. Reserve bypass for disposable directories.
• Connect scoped, revocable tokens rather than account-wide ones, and prefer test-mode keys while building.
• Open the specific project directory rather than your home directory.
• Review diffs before pushing, particularly anything touching authentication, payments or infrastructure.
• Rotate a credential immediately if you suspect it has leaked, and unlink it in Settings, then Connections.

Write to support@useclodex.com with sufficient detail to reproduce the issue. Please report privately and allow a reasonable opportunity to remedy the matter before publication.

We will acknowledge your report, keep you informed of the remedy, and credit you should you wish to be credited. We will not pursue legal action in respect of good-faith research that remains within your own account and data, avoids privacy violations and service degradation, and does not access the information of others.