Security

Runs happen on your machine

Recipes execute in the desktop app or the browser extension, on your computer, using your own logged-in sessions. Our servers do not hold your Recipes’ data and are not on the path of a run. The product keeps working with the network unplugged.

Credentials

The desktop app keeps credentials in a local vault and fills them into pages itself, so a Recipe script never sees a password. The browser extension supports OAuth-style credentials only, because extension storage is not a safe place for passwords.

Community Recipes

Every published Recipe is signed and checksummed, and a person reviews it before it is listed. Installing one verifies the checksum. A Recipe declares the sites, paths and tools it may touch, and the runtime holds it to that declaration.

AI providers

You choose the model. With a local model, nothing leaves your machine. With a cloud provider, the AI steps of a Recipe send their inputs to that provider under its terms, and only those steps.

Reporting a vulnerability

If you find a security issue, tell us before you tell anyone else. We will acknowledge within three business days.

Contact ushello@anyrepeat.ai