SuperX Code runs locally by default. User prompts, attachments, and session data are processed through user-configured providers (Anthropic, OpenAI, Google, Amazon Bedrock, or others). The application does not operate a proprietary hosted model service by default.
The terminal interface uses secure process isolation. Bash and external executions run with host user authority; structured external directory checks enforce workdir boundaries.
Credentials remain isolated per user and transmitted only to the selected provider APIs. The built-in registry validates built-in IDs before any external dispatch.
Agent execution includes permission checks by default. Failures produce operational errors rather than lossy successes. Structured settlement layers enforce output boundaries.
File and image attachments are processed locally and transmitted to configured providers only when included in a prompt. No independent attachment storage operates independently.
Portions derived from open-source OpenCode remain subject to the MIT License with required attribution. All third-party dependencies retain original licenses.