Security

SuperX Code runs locally by default. User prompts, attachments, and session data are processed through user-configured providers (Anthropic, OpenAI, Google, Amazon Bedrock, or others). The application does not operate a proprietary hosted model service by default.

Local Processing

The terminal interface uses secure process isolation. Bash and external executions run with host user authority; structured external directory checks enforce workdir boundaries.

Provider Isolation

Credentials remain isolated per user and transmitted only to the selected provider APIs. The built-in registry validates built-in IDs before any external dispatch.

Permission Guards

Agent execution includes permission checks by default. Failures produce operational errors rather than lossy successes. Structured settlement layers enforce output boundaries.

Attachments

File and image attachments are processed locally and transmitted to configured providers only when included in a prompt. No independent attachment storage operates independently.

Open Source Components

Portions derived from open-source OpenCode remain subject to the MIT License with required attribution. All third-party dependencies retain original licenses.

Next: FAQ · Home