security
Nothing leaves the machine you did not configure.
The safety model as the README states it, then how the hosted service treats what you give it, how to report a problem, and where the paperwork stands.
security and deployment
Four layers in front of every tool call. Nothing leaves the machine you did not configure.
The safety model as the README states it, limits included. Each layer names what it decides and where it stops; none of them is a sandbox.
layer
decides
limit
layer 01
01rulesDeny-default wildcard policy rules over tool and argv. A forbidden pattern is denied before anything runs.
limitPattern matching, not intent: a novel spelling of a dangerous command passes to the next layer.
layer 02
02execpolicyVerdicts on the parsed argv: allow, prompt, forbidden. Forbidden never reaches execution or a human.
limitReads the command, not the shell it will run in; an alias or a script body is opaque to it.
layer 03
03approvalOne card on the revised args with allow, always and deny. Answers are cached per session; child agents cannot prompt.
limitA human decision: --yolo skips this rung, never the deny rules above it.
layer 04
04runtimeA bash denylist and a cwd lock at execution; Esc kills the running call and, on Windows, its whole process tree.
limitDelegation, not isolation. Untrusted work belongs in a container or microVM.
deployment and data
01
Self-hosted by definition
Runs from source on your machine or your CI. An account is optional: it unlocks the plans on the pricing page and never gates the CLI. Bun ≥ 1.3.14 is the one requirement.
02
No phone-home
Outbound traffic goes only to the provider you configured, the MCP servers you listed and web_fetch when the model asks. Pricing catalog is an offline snapshot; there is no self-update.
03
Telemetry is opt-in
OpenTelemetry export is off until ROVECODE_OTEL_ENDPOINT is set; even then it carries ids, sizes and outcomes — never prompts, arguments or output.
04
Audit trail by construction
Sessions are append-only JSONL with a sha256 hash chain; every run exports one trace (run ⊃ turn ⊃ tool), including cancelled ones.
05
Platform status
Windows-first: development and the release gate run on Windows 11. POSIX paths are tested, Linux and macOS are not yet CI-verified.
06
License
AGPL-3.0-only. Modify and redistribute freely; running a modified build as a network service obliges you to offer its source to those users.
responsible disclosure
Found something? Tell us first.
01
Report privately
Write to the address below with what you found and how to reproduce it. Encrypted mail is welcome; a plain one is fine.
security@rovecode.dev
02
What happens next
An acknowledgement within two working days, a fix or a plan within thirty, and credit in the release notes if you want it.
03
Safe harbour
Good-faith research within the rules — no data taken, no service disrupted, no third parties involved — will not be met with legal action.
your data
What we hold, and for how long.
01
The agent
Runs on your machine. Its traffic goes to the model providers and MCP servers you configure, and nowhere else.
02
Your account
Name, email, a password hash or the identifier your sign-in provider gives us, and the plan you are on.
03
Telemetry
Off until you set an OpenTelemetry endpoint; even then it carries identifiers, sizes and outcomes — never prompts, arguments or output.
04
Retention
Account data for thirty days after you close the account; billing records for as long as tax law requires; access logs for thirty days.
compliance
Where the paperwork stands.
Placeholder statuses, written for the page — the real ones replace them before launch.
01
SOC 2 Type II
Controls written and evidence collection under way; the report is planned for next year.
02
Penetration test
An annual third-party test of the hosted service; the summary letter is available under NDA.
03
Status page
Availability and incidents for the hosted service, published as they happen.
