End-to-end safety
How CodeStilt keeps code, secrets and computers safe at every step.
| Step | Protection |
|---|---|
| Sign-in | One-time email code or link (15 minutes, code limited to 5 tries and the same browser), Google or GitHub with PKCE; server-side sessions; sign out everywhere |
| Linking a computer | Short code shown on both screens, expires in 10 minutes, warning if the request comes from another network |
| Reading the project | Allowed folders only; secret files never read; secrets inside files hidden before sending |
| Planning | Project text treated as data, never instructions; suspicious instructions are flagged in the plan |
| Changing files | Scope lock; no paths outside the folder; checkpoint first |
| Running commands | No shell; never-allowed list; database, deploy and install ask first; extra check before tests when build files or risky code changed |
| Billing | Hard cap; payment messages checked with a signature; plans set only from what was really paid |