Security

CodeMorph is a desktop editor that reads your source code, so we've designed it to need as little trust as possible. The best protection for your code is never receiving it, and CodeMorph's architecture doesn't send it to us.

Architecture

On your machine

• The editor, the CodeMorph desktop app for Windows.
• The migration engine. Parsing, import resolution, the dependency graph and the migration plan all run locally. The graph is stored in a local SQLite database.
• Verification. tsc, your test suite and your build run locally, in your environment.

With your model provider

Conversion and Ask requests are sent directly from your machine to the provider you configure, using your own API key and governed by your agreement with that provider. Scanning, planning and verification make no model calls.

With CodeMorph

• No source code. There is no CodeMorph service that receives code.
• No app telemetry. Telemetry is disabled and crash reports have no destination in the product configuration.
• Website only. If you submit a form on this site, we receive what you type into it. See the privacy policy.

API keys

Keys set with CodeMorph: Set API Key are stored in the editor's secret storage, which is encrypted using the operating system's credential protection and scoped to the CodeMorph extension. Keys are never written to settings.json, never included in settings sync and never logged.

Workspace trust

The CodeMorph extension does not run in untrusted workspaces. The editor's standard Restricted Mode applies until you trust a folder.

Extensions

The Extensions view installs from Open VSX. Extensions run with full access to your workspace, as in any desktop editor, so install only extensions you trust.

How we build CodeMorph

• Pinned sources. Every build starts from source versions recorded in the repository, so builds are reproducible.
• Small, named changes. Our changes to the editor are a short, named list applied at build time, which makes them easy to review.
• Automated guards. Every build checks branding and checksums the logo files, so nothing can be altered silently.
• CI builds. Windows installers are built by continuous integration from tagged commits and published to GitHub Releases.
• Tested engine. The migration engine has an automated test suite covering parsing, resolution, the graph store and planning, run on every release build.

Extension host and AI isolation

Extensions run in a separate extension host process. Third-party AI integrations are not built in; Morph is the only built-in agent.

Installers and updates

• Installers are built by CI from tagged source and published to GitHub Releases.
• Beta installers are not yet code-signed. Windows SmartScreen will warn on first run. Only download from this site or our GitHub Releases. Signed installers are on the roadmap.
• The beta has no auto-updater. New versions are announced in the changelog.

Incident response

If we learn of a vulnerability or incident affecting CodeMorph users, we'll investigate, fix it, publish an updated build and describe the issue and the fix in the changelog. If personal data we hold is affected, we'll notify the people concerned and the relevant authorities as the law requires.

Reporting a vulnerability

If you believe you've found a security issue in CodeMorph or this website, please email support@codemorph.codes with:

• A description of the issue and its impact.
• Steps to reproduce, or a proof of concept.
• The CodeMorph version (Help → About) and your OS.

We'll acknowledge your report within three working days and keep you updated as we investigate. Please give us reasonable time to fix the issue before disclosing it publicly. We won't pursue legal action against good-faith research that avoids privacy violations, data destruction and service disruption.

Supported versions

Security fixes are made in the latest beta release.

What we don't have yet

CodeMorph is an early-stage company. We don't currently hold SOC 2, ISO 27001 or similar certifications. If your organization needs a security review, contact us: because your code doesn't reach us, most reviews focus on the desktop app and are short.