Security

End-to-End Encryption

All traffic between your browser and your local VS Code passes through our global edge network over TLS. The tunnel connection from your machine to the edge is also encrypted, meaning no plaintext data ever traverses the public internet.

Credential Storage

API keys and tokens are stored exclusively in your operating system's secure keychain. Credentials never appear in configuration files, log files, or synced storage. The extension never transmits credentials to our servers.

Access Control

The local development server runs behind an authentication layer. Every HTTP request and WebSocket upgrade is verified against the API key before reaching VS Code. Without valid credentials, connections are rejected at the access layer.

Zero Trust Architecture

MR Multi Model AI Coder follows a zero-trust model:

• We never see or store your source code.
• We never see or store your API keys.
• Tunnel traffic flows through our edge network — we do not operate relay servers between you and your machine.
• Device UUIDs are generated locally and tied to your machine, not to our infrastructure.

Reporting Vulnerabilities

If you discover a security vulnerability, please report it responsibly to [email protected]. We take all reports seriously and will respond within 48 hours.