Security

Security is a design constraint of Hynah, not an afterthought. As an agentic IDE that can read your code and act on your behalf, we hold ourselves to a higher bar: minimize what leaves your machine, make agent actions visible and reversible, and make it easy to tell us when something is wrong.

1. Local-first architecture

• Repositories, project memory, and task state are stored locally on your device by default.
• Cloud AI requests are made directly to the provider you select. Where you configure your own API keys, keys are stored in your operating system's secure credential store — never on our servers.
• Local models run fully offline.

2. Agent guardrails

• Agents act inside an explicit task scope; file writes and shell commands are shown in a reviewable diff before they are applied.
• Destructive or outward-facing actions (push, deploy, delete) require confirmation by default.
• Every agent run is logged locally with inputs, actions, and outputs so you can audit and roll back.

3. Data protection

• All network traffic uses TLS 1.2+ with certificate validation.
• Workspace sync, when enabled, is encrypted in transit and at rest.
• Access to production systems is limited to authorized personnel under least-privilege, with multi-factor authentication enforced.
• Telemetry is opt-in and never includes file contents, prompts, or secrets.

4. Application security

• Signed installers and notarized macOS builds; SHA-256 checksums are published for every artifact on the download page.
• Auto-updates are delivered over authenticated channels and verified before installation.
• Dependencies are pinned, scanned for known vulnerabilities, and reviewed before release.

5. Vulnerability management

• We triage reported vulnerabilities within 72 hours.
• Critical fixes ship as out-of-band patches; other fixes ship in the next regular release.
• We publish security notes with each release when a fix affects users.

6. Responsible disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability in Hynah:

• Email support@hynah.com with the subject line "Security report".
• Include a description, affected versions, and steps to reproduce.
• Give us a reasonable window to investigate and patch before public disclosure.
• Do not access, modify, or delete data that is not yours, and do not degrade the service for others.

We commit to acknowledging your report within 3 business days and keeping you updated until resolution. We do not pursue legal action against good-faith research that follows these guidelines.

7. Incident response

If a security incident affects your data, we will notify affected users without undue delay, describe what happened and what data was involved, and share the steps we are taking.

8. Contact

Security questions and reports:

• Email: support@hynah.com
• Phone: +91 76973 69216