Security

01CLI safeguards

• Diff before write. Every file edit is shown as a diff to accept or reject. /undo restores the files changed in the last turn.
• Permission prompts. Commands that delete files, push with git, rewrite history or install packages always ask: allow once, always allow in this project, or deny.
• Sandbox on Linux. Commands run in a bubblewrap sandbox with no network and writes limited to the project. Where no sandbox is available (Windows, or Linux without bwrap), each command asks for permission unless you pass --yes.
• Protected commands. Sign-in, sign-out and update can’t be run from the agent’s shell, and !command goes through the same filter.
• MCP tools. Read-only MCP tools ask for permission once per server.
• Plan mode. Shift+Tab lets the agent read and plan without changing anything until you approve.

02Authentication

• Website sign-in with an emailed one-time code, Google or GitHub, via Neon Auth.
• The CLI signs in through the browser using PKCE and a one-time code; tokens are never placed in the URL.
• The hosted MCP server uses OAuth.

03Software integrity

Standalone CLI binaries are verified against published SHA-256 checksums (SHA256SUMS) before zoreva update replaces them. Very old CLI versions are told to update instead of continuing to run. Checksums for the MCP skill and plugin are published on the Trust page.

04Infrastructure and data

• All traffic to zoreva-ui.com uses HTTPS (TLS), with Cloudflare in front for DDoS and bot protection.
• Data is stored in Neon (managed Postgres) with encryption at rest provided by the platform.
• Models are called through Amazon Bedrock; prompts aren’t used to train models.
• Payment card data is handled by Stripe and never touches our servers.
• Secrets are kept out of the repository and checked automatically; admin access is limited to named accounts.

We don’t currently hold third-party security certifications. Providers we rely on are listed on Subprocessors.

05Your data in the CLI

Crash reports are off by default and never include code, prompts or file contents. See the Privacy Policy for what is sent when you use ZOREVA-UI models.

06Report a vulnerability

Email legal@zoreva-ui.com with “Security” in the subject, steps to reproduce and the impact. Please give us reasonable time to fix the issue before disclosing it, don’t access or modify other users’ data, and don’t run tests that degrade the Service. We’ll acknowledge reports and keep you updated. We don’t run a paid bug bounty at this time.