ForgeFlow is built on defence in depth. These are the primary controls that protect your data and generated applications.
Every private table is protected with RLS scoped to the signed-in user.
AI keys never touch the browser. Requests are routed based on complexity and safety.
AI file operations are validated with Zod before being applied. Invalid paths and directory traversal are rejected.
Live preview runs isolated from the platform. Generated code cannot access platform secrets.
Screenshots and images are stored privately. Access uses signed, time-limited URLs.
Content inside uploaded files, code and databases is treated as untrusted input, not as system instructions.
Database drops, file deletions and large refactors require explicit approval.
Security, performance and accessibility audits scan the project — with a clear note that automated scans cannot guarantee complete coverage.
Automated scanning cannot guarantee complete security. For high-risk workloads, we recommend a manual review before publishing.