§ Platform / Security
Security by construction, not by policy.
Scellis runs code written by other people on your machine, and gives AI assistants real control — so safety here cannot be a policy document. It is built as refusal: untrusted code runs where a network call is structurally impossible, your credentials never exist on a server, the server itself works out who is calling, and no agent can ever move money. What is left to defend is small, layered, and published — boundaries included.
A deliberately small attack surface
The stance begins with subtraction. Scellis never mints a password — signing in is delegated to GitHub, so account recovery and two-factor live with the identity provider you already trust. Connector secrets are encrypted on your device and never synced. And because computation is local-first, using Scellis never requires uploading your data anywhere: what you don't share simply never exists on a server — and what never exists cannot be breached, subpoenaed, or quietly retained.
What ships is equally subtractive: the Studio carries no third-party analytics at all, and it may talk to a single, tested list of destinations — every other address is refused by the browser itself, one layer below our own code. Product telemetry is opt-in and carries no personal data. What you are asked to trust here is small enough to enumerate, and this page enumerates it.
Seven layers, each refusing on its own
| Layer | Mechanism | What it refuses |
|---|---|---|
| Identity | Every request carries a subject the server established — a session, a scoped API key, or an attributable anonymous token. | Forged or anonymous writes |
| Isolation | Row-level security inside the database: visibility, membership, and sharing are checked where the data lives. | Reading or writing across accounts |
| Compute safety | Trust tiers, a sandbox with the network stripped out of it, an effect policy, and resource budgets. | Data leaving through untrusted code |
| Integrity | Everything is named by the hash of its bytes; every load verifies that hash before use. | Silent tampering or corruption |
| Accountability | An append-only stream of changes plus a queryable audit log. | “We don't know what happened” |
| Abuse resistance | Rate limits and scoped endpoints on the server; anonymous identities get stricter budgets. | Flooding and resource abuse |
| Commercial access | The entitlement check runs on the server; the client is cosmetic and assumed forgeable. | Plans or paid features forged in the client |
Layers fail independently: a bug above meets another refusal below. No row is a courtesy of the interface.
No single layer is load-bearing. Identity is established on the server and threaded into every request. Multi-tenant isolation is enforced inside the database itself, beneath every route — a bug in the interface cannot widen access, because the layer that refuses is one no client can route around. Sharing with a specific person is an edge the database checks, never a flag a client merely displays.
Governance rides the same enforcement. A workspace policy can require signed content only, forbid network effects, or pin deterministic execution — and the interface cannot override it, because the policy is checked where the data lives. Every change lands an event and the audit log is queryable, so “we don't know what happened” is a failure mode designed out, not an incident-response hope.
User code runs where the network does not exist
The hard problem of an extensible platform is that everything users write — kernels, operators, viewers, connectors — is code, and it runs on your machine. Scellis runs it in a place where the browser's own network calls have been removed: fetch, WebSocket, and XMLHttpRequest are not present at all, so a network call from user code is structurally impossible — not caught afterwards, but inexpressible. The only door is a gate you have to approve.
Effects are the whole policy: declared by whatever uses them, denied by default when unknown, consented to at the moment they matter, and recorded afterwards. Computation itself is never restricted — the sandbox bounds resources and side-effects, never expressiveness. And trust is earned, not assumed: sandboxed code widens its standing through conformance evidence, never through who wrote it.
Composition cannot launder privilege either. Anything called runs at the strictest trust tier in its own call chain — an unverified helper stays sandboxed even when trusted code invokes it — and effects add up along that chain, so a “pure” block cannot smuggle a network call in through a dependency. The same checks gate the content we ship: what you write and what we ship are one pipeline, and privileging ours would be a bug.
Signed content, trust that is earned
Everything you install arrives as a signed, versioned Pack. The signature and the content hash are both verified before anything activates, and what a bundle actually is gets decided by decoding and validating it — never by its filename. Signing keys are ordinary catalog entries, so rotating one is an ordinary catalog change; the private half stays on the author's device and is never synced.
Trust is a readable signal, not a vibe: unverified → community → verified → official, earned through conformance evidence and review, and independent of who wrote the thing — community work can reach verified. And because the bytes behind a published hash can never be silently swapped, a compromise gets a real channel instead of a quiet patch: an advisory notifies everyone pinned to it, marks the entry, and can block new installs — while people who already hold it keep running and decide with full information.
The same suspicion extends to prose. Every piece of text other people wrote — descriptions, notes, reviews, method cards — goes through one renderer that strips anything executable before it reaches the page. A malicious description cannot take over your Studio, because there is no unfiltered path for it to ride in on.
Full power for agents — never your money
The Copilot holds the same verbs you do, so its safety cannot rest on it having less power. Enforcement is on the server, always: the consent ladder and the server-derived caller are checked on every request, and money is barred to every machine caller — a prompt-injected Copilot, a leaked API key, a headless session: none of them can buy.
Access for outside agents over MCP is specified end to end and being built now for early access; how that surface is generated, and what an agent may touch, is on the API page. What no architecture can eliminate — an injected agent misusing scope you already granted — is written down plainly in honest limits, not rounded away.
What you get, by design
| Property | Guarantee |
|---|---|
| Signed content | Signature and content hash are verified before anything installs; what a bundle is gets decided by validation, never by its filename. |
| Delegated identity | Signing in is GitHub OAuth; recovery and two-factor live with the identity provider — Scellis never mints a password. |
| Credentials stay with you | Connector secrets are encrypted on your device with AES-256-GCM and never synced — there is no server copy to steal. |
| A Studio that phones nobody | No third-party analytics; the app talks only to one tested list of destinations — the browser itself refuses the rest. |
| Erasure that means it | Personal data lives in a per-person store whose key can be destroyed; erasure destroys the key, and append-only logs never carry identifying data. |
| Atomic engine updates | A new engine is verified against a signed hash before it activates, then swapped in one step — a half-updated engine never runs. |
| Isolation at the database | Row-level security beneath every route — the layer that refuses is one no client can route around. |
Each property below names the structure that enforces it, and where a guarantee has a boundary, the boundary is published rather than rounded up. The engineering behind every row is laid out in the security deep-dive.
One rule runs through all of it: a hash of personal data is still personal data — we never call it “anonymized”. Erasure is engineered as key destruction: identifying data lives in a per-person store whose key can be destroyed, and the append-only logs never carry it in the first place, so deleting actually deletes instead of merely hiding.
When something goes wrong, the path is published
Public surfaces get one governance spine rather than per-surface improvisation, and it lands with early access in exactly this shape: anything public is reportable, every report enters one review queue, every action carries a written reason, and every author affected has a route of appeal. The boundary holds even under enforcement — a suspension removes platform services like sync, publishing, and pools, while local computation on content you already hold continues unconditionally. Moderation never gates computation, and content already installed is never remotely killed.
The platform holds itself to the same discipline. A personal-data breach is notified to the supervisory authority on the GDPR's 72-hour clock, and to the people affected where the risk is high — the audit spine exists precisely so that assessment is answerable. Vulnerability reports are handled as coordinated disclosure with a stated triage-and-fix service level: an acknowledgment for every report, the fix before the public detail, and credit for researchers who want it.
Found something? Write to security@scellis.com with what you observed, the steps to reproduce it, and the part of the platform affected. Good-faith researchers are treated as collaborators in coordinated disclosure, never as abusers. For everything that is not a vulnerability — press, partnerships, questions — use the channels on the contact page.