Local-first. Secure by default.
Flame integrates deeply with your filesystem, git, terminals, and AI agents, so its security model starts locally: loopback by default, authenticated connections, protected credentials, and explicit permission decisions for agent actions.
Your code stays on your machine.
Flame reads your files locally and binds to loopback. Nothing is uploaded to run the workspace. Code only reaches an AI provider when you ask an agent to act, and with a local model, it never leaves at all.
The local server is powerful, so access is narrow
Flame can read files, run terminals, drive Git, and start agents. Its connection controls are designed around that capability.
Loopback by default
The workspace server binds to 127.0.0.1 unless you deliberately change it. Secure Relay keeps that server on loopback while the host makes an outbound connection.
Authenticated HTTP and WebSockets
API requests and terminal, agent, file-watch, debugger, and language-server WebSockets require a bearer token. Failed upgrades are rejected before a bridge is opened.
Browser-origin defenses
An explicit CORS allowlist, restrictive Content Security Policy, clickjacking protection, content-type protection, and a no-referrer policy reduce what an unrelated page can reach.
Security audit trail
Terminal spawns, file writes and deletes, Git pushes, and agent tool calls are written to a separate local audit log with user-versus-agent attribution.
You decide what's shared, and with whom
- Run Claude Code, Codex, or Gemini through Antigravity with the vendor account you choose.
- For direct model access, choose Anthropic, OpenAI, Gemini, OpenRouter, a gateway, or a local compatible endpoint.
- With a local endpoint such as Ollama or LM Studio, AI requests stay on your device.
- Per-scope permissions decide what an agent may read or change.
- Tokens are encrypted at rest and never returned to the client.
- Crash reports stay local until you choose to send one, and you can inspect the full report first.
- Home-directory and operating-system username details are redacted from crash reports.
Encrypted content, explicit pairing, honest metadata
Anywhere mode is designed so the relay can move workspace traffic without being able to decrypt it.
Remote Access is off when you do not need it. To pair, scan a short-lived QR code, verify the six-word host fingerprint, and type the phone's two-digit number into Flame on the host. A photographed QR alone cannot complete pairing.
What Secure Relay guarantees
The host and device use a Noise IK end-to-end encrypted channel with the host public key pinned through the QR. The relay never receives a session key or plaintext workspace content.
What the relay still observes
The relay can see that a registration is online, rotating rendezvous identifiers, connection timing and volume, and live socket IP addresses. IPs are held in memory for the connection, not persisted.
What you can revoke
Pairing codes are single-use and short-lived. Devices can expire, revocation closes live circuits, and rotating the host identity unpairs every device.
The browser-client boundary
The browser companion is JavaScript served from connect.flame-ide.com. That delivery origin is inside Flame's trust boundary: a compromised client build or delivery path could read plaintext.
Remote Access is optional. See the Remote Access guide for pairing, metadata, device revocation, and the browser-client trust boundary.
Found something? Tell us.
We take security reports seriously and respond quickly. Please disclose privately using this secure form so we can protect users while we fix it, or contact us directly via email.
Direct email: security@flame-ide.com