Security

How Kojo handles code, credentials and access.

Your code runs in a computer that belongs to one session. Here is what is inside it, what can read what, and what we are still closing. We hold no security certifications today.

On this page: how it fits · isolation · what the computer can read · credentials · access · previews · records · known limits · report

How it fits together

your browser
    │
    ▼
the app and its API ──────▶ your workspace's data: sessions, activity, credit
    │           │
    │           └─────────▶ GitHub, with Kojo's own access: pull requests, merges
    ▼
one computer per session ─▶ the repositories you picked (the agent pushes its branch)

Isolation

computer     one per session
shared       nothing between sessions
lifetime     destroyed when its session is archived

What code in the computer can read

Read this before you connect a sensitive repository. Any code running in a session's computer, the agent's or a teammate's, can read what that computer holds: the run's own token, its git token, the model key its run uses, the secrets attached to the session, and the keys a member put in their terminals. Its network access is open.

A per-request proxy that keeps keys out of the computer is planned, not built. Use keys and tokens limited to what the session needs.

Credentials

What	How it is handled	Status
Keys, secrets and saved logins	Stored encrypted, per company, per person or per session. No page or API response shows a value back. Shared only with the people you choose.	Available
What a run receives	Only the secrets attached to its session, re-checked at the start of every run: a revoked or unshared secret is not given.	Available
Stored output	Activity, transcripts and results a run stores are masked on the server for every secret the computer holds.	Available
Terminal output	Secrets are masked in terminal output, and a setting decides who may open a terminal on a computer that holds them. Masking is best effort, not a boundary.	Preview
GitHub access in the computer	With the GitHub App: a token for the session's repositories only, new each run and revoked at its end. With a personal token you connected: that token.	Preview
Keys of ours	None is put in a computer: models and the web browser use your own keys, or go through Kojo without the key entering the computer.	Preview
Pull requests	Opened and merged by Kojo with its own GitHub access, never from the computer; a merge only on a person's approval of that merge.	Available

The tests for secrets, sharing and redaction are each checked to fail when the guard they cover is removed.

Who can do what

Your browser never reads session data from the database directly: every read goes through the API, which checks the workspace and the session membership first.

Session roles are listed on the product page. API keys are scoped and never more than automation. Removing a member takes effect on their next request. Preview

The API description is shown only to signed-in members and keys, and lists only what that workspace can call.

Previews

Each preview is served on its own origin through a signed link.

Viewers reach only the session's declared preview port; links expire after 15 minutes. Preview

Privacy and records

We keep operational records needed to run, secure and bill your workspaces: sessions, who did what, approval decisions and per-member usage. We do not provide employee productivity scores, keystroke or screen tracking, or rankings of individuals.

Known limits

Code in a computer can read the secrets that computer holds, and its network access is open (above).
Everyone in a session sees all of its repositories; there is no per-member split inside one session.
Masking hides known values in output; it does not stop someone who types from sending a secret elsewhere.
We hold no security certifications.

We publish these here rather than let someone find them.

Report a vulnerability

Email security@kojo.build.