Skip to content

SECURITY · LOCAL-FIRST

Your code never leavesyour machine.

No proxying. No mirroring. Memory is encrypted before it crosses the device boundary.

plaintext · on device
›function auth(user) {

01 · TOPOLOGY

Two separate worlds.

Code path stays on your machine, going direct to your chosen model provider. Memory path is encrypted on device before anything reaches our cloud.

direct · plaintext (your wire) encrypted · ciphertext (our wire)

02 · WHERE EACH THING LIVES

No hidden copies.

ThingWhere
Your source codeStays on your machine. We never receive it.
Model trafficDirect from your machine to your provider. We never proxy a token.
Memory chunksEncrypted at rest in our DB.
Model API keysEncrypted at rest in our DB.
Orchestration metadataOur DB. Job IDs, timestamps, role labels.
Account + billingEmail, plan tier, Stripe references.

03 · MEMORY PIPELINE

Four stages, all on device.

Your plaintext is never on the wire. Each chunk gets a fresh AES-GCM nonce.

  1. 01tree-sitter

    AST chunker splits your code into chunks.

  2. 02BGE-small-en-v1.5

    Embeddings happen on your device (384-dim).

  3. 03AES-256-GCM
    a3f1 9b5c d1a8 e7c2 4f6d 0c91

    Each chunk is encrypted before it leaves.

  4. 04milvus.upsert()
    a3f1··e7c2

    Ciphertext stored at rest in Milvus.

Plaintext never crosses the device boundary.

04 · WHAT WE HAVE

What we have access to.

  • Job IDs, agent IDs, workspace IDs
  • Phase change timestamps
  • Account email + plan tier
  • Stripe billing references

05 · WHAT WE CAN'T

What we cannot access.

  • Your source code. It never leaves your machine.
  • Your model conversations. Traffic is direct: your machine to your provider.
  • Your memory in plaintext. Stored encrypted at rest.
  • Your API keys in plaintext. Stored encrypted at rest.
AES-256-GCMAuthenticated encryption
Local embeddingsBGE-small on-device
No-proxy trafficModel calls direct
Encrypted at restCiphertext-only storage
Open dependenciesAll pinned, auditable

06 · DISCLOSURE

Reporting issues.

Found a vulnerability? Email security@forestops.app. We respond within one business day and credit reporters in the changelog.

PGP fingerprint4F3A 9C21 7B8E 5D0C 1A6F 8B92 3E4D 7C58 A0F1 9E62

Email security Coordinated disclosure