Security

Last updated: September 2026

You are considering pointing an AI at your source code. That deserves specifics, not adjectives. This page says what OIOXO can reach, what our servers see, and where the gaps are — including the ones we would rather not advertise.

Your code stays on your device

This is architecture, not policy. OIOXO’s models run in your browser or on your machine, so there is no server to send your files to. Your project lives in your browser’s own storage or in a folder you opened from disk; the editor, the search index and the AI all read it locally.

Two consequences worth stating, because they are the reason we can make this claim at all: we could not read your code if we wanted to, and we could not recover it for you if you lost it. Keep your own backups and use Git.

What our servers actually see

Four things, and no file contents in any of them:

Your account, if you make one — email, plan, and how many tokens you have used against your allowance.
Model downloads. Fetching a model is an ordinary file download; we see that a model was requested, as any host would.
Crash reports, capped at five per session. File paths and names are stripped from the message before it is truncated, so a long path cannot push the redaction out of range. A dedicated test covers this.
Support tickets you send, from Help → Report a problem. These carry what you typed plus a diagnostic line: version, tier, plan, model name, CPU core count, browser string, and the last error. Never code, never prompts, never file names.

The exception: web search is on by default

One thing does leave, and we would rather you read it here than discover it. When the AI decides a question needs current information, it writes a search query and sends it to our search proxy, which passes it to Brave or DuckDuckGo and caches it for ten minutes. This is on by default, and unlike editing a file it does not ask first.

This applies to plain chat, not to the coding agent. The agent that reads and edits your files is not web-grounded, so nothing it reads and no file content ever becomes part of a search query. What can leave is a query the model wrote from a question you asked it in conversation — so if you paste a snippet into chat and ask about it, treat a query describing that snippet as having left the device.

Turn it off in Settings → oioxo.grounding.enabled. It is read per request, so it takes effect immediately with no reload. With it off, and with no account and no API key of your own, nothing you write reaches us at all.

If you bring your own API key

Your key is encrypted at rest in your browser’s storage and is never sent to OIOXO. It goes directly from your browser to whichever provider you chose, and it never appears in crash reports or diagnostics.

The honest caveat: when you use your own key, your prompts and the file excerpts the AI reads go to that provider, under their terms — not ours. That is the trade for a larger model. The on-device modes have no such exchange.

Accounts and payment

Passwords are hashed with bcrypt. Sign-in is rate limited, and email verification is enforced at login rather than merely requested.
Passkeys are supported, and are the better choice — there is no password to steal or reuse.
Sessions can be revoked, and signing out of a deleted account happens immediately.
We never see your card. Payment is handled entirely by Stripe’s hosted checkout; card numbers never touch our servers.
You can export your data and delete your account from your account page. Deletion removes the record, it does not merely hide it.

How the browser is locked down

Every response is served over HTTPS with HSTS, a one-year max-age and subdomains included. The app is isolated from other origins (Cross-Origin-Opener-Policyand Cross-Origin-Embedder-Policy), cannot be framed by another site, refuses MIME sniffing, and switches off geolocation, USB, payment-request and interest-cohort access at the header level. You can verify all of this yourself with your browser’s network tab — that is rather the point.

What we do not have is a full Content-Security-Policy: ours restricts who may frame us, and does not yet restrict what may execute. So the residual risk is the honest one — a cross-site scripting flaw in our own code could reach what the page can reach, including a stored API key. The key is encrypted at rest and its wrapping key cannot be read out of the browser, which raises the bar; it does not eliminate that class. Closing it properly means a real CSP, and that is on the list rather than done.

What the AI is allowed to do

The agent edits files in the folder you opened, and nothing outside it. Every change it makes is reviewable and undoable — per hunk, per file, or a whole run at once — and it is not permitted to edit OIOXO’s own configuration.

Running a command is separate from editing a file, and it is gated separately. Under the default setting, anything that runs a command or deletes something asks first. There is also a floor no setting can lower: running a shell command and calling an external tool server always ask for confirmation, even on the most permissive setting — a shell command starts a process on your machine, and an external tool server is defined by someone else.

Be deliberate about the most permissive setting, though. It keeps that floor and drops the rest, so file deletions stop asking. If that is not what you want, stay on the default.

Pages you open in the built-in preview run in a sandboxed frame with no access to your files or your session.

What we are not claiming

The part most security pages leave out. None of these are secret; you would find them, and you should not have to look.

No third-party audit or penetration test has been done. Everything above is our own review of our own code.
No paid bug bounty. We will credit you and fix it quickly; we will not pretend a reward programme exists.
The desktop installer is not yet code-signed, so Windows SmartScreen will warn you. Checksums are on the download page — check them, and treat an unsigned installer with the caution it deserves.
No SOC 2, ISO 27001 or similar. We are a small team and have not been through those processes.
Browser storage is not a backup. Clearing site data deletes a project kept in the browser. Use a folder on disk, or Git, for anything you would be upset to lose.
Crash and usage reporting is on by default, not opt-in. It is seven fixed fields and a redacted error message, and the switch is in Settings — but you did not have to ask for it, so we should say so.
Opening a folder does not warn you. Some editors ask before trusting code from an unknown source; OIOXO does not prompt today. Treat an unfamiliar project with the same caution you would anywhere else.
Model downloads are checked for integrity, not provenance. Every model is verified against a SHA-256 checksum and the download is aborted on a mismatch, so corruption and tampering in transit are caught. The checksum comes from the same server as the model, so it is not a signature: it does not prove the file came from us if our server were compromised.

Reporting a vulnerability

Email support@oioxo.com. There is also a security.txt at the usual location.

Most useful to us, in rough order: anything that lets one account read or bill another; anything that extracts a key or source code from a user’s browser; anything that lets a page outside oioxo.com drive the IDE.

Please give us a reasonable window to fix before publishing, and please do not test against accounts that are not yours. We will tell you what we found, what we changed, and when — and we would rather hear from you than read about it.