Last updated: July 20, 2026
CodeGrid is built so there is very little to secure: it is local-first, collects nothing, and is fully open source. Below is exactly how the current build handles your code, credentials, and updates — all verifiable in the source.
CodeGrid runs entirely on your machine. Your terminals, code, prompts, and project files never pass through ZipLyne servers — there are none. The desktop app ships with no telemetry, no analytics, and no crash reporting, and it requires no account, sign-up, or license key.
The complete source code is published on GitHub under the MIT license. Anything we claim on this page can be verified by reading the code. There is no closed-source server component to trust.
Release builds are signed with an Apple Developer ID certificate issued to ZipLyne LLC (Team ID DHGG5BA7J7), built with the macOS hardened runtime, and notarized by Apple. Auto-updates are delivered as signed artifacts and verified with a minisign public key before they are applied, so an update cannot be tampered with in transit.
File and Git operations performed by the app are validated in the Rust backend: every path is canonicalized and constrained to your home directory or /tmp, path-traversal (..) and symlink escapes are rejected, and file-scoped Git commands run with literal pathspecs so a maliciously-named file cannot widen an operation. Precious config files (e.g. .claude.json) are written atomically to avoid corruption.
Agent CLIs authenticate with their own existing logins. If you enable CodeGrid's optional OpenAI-powered review, commit-message, terminal-summary, or voice features, the key you provide is stored in macOS Keychain. Venice keys are requested with hidden input and held only in that pane's process environment. GitHub authentication uses the GitHub CLI and your operating system keychain; CodeGrid refuses to write tokens to disk in plaintext (it rejects the insecurecredential.helper=store mode).
Agent CLI requests flow directly to their providers under those providers' terms. When you explicitly use CodeGrid's BYOK AI extras, the relevant diff, terminal text, or voice audio is sent directly from the desktop app to OpenAI using your key. ZipLyne does not proxy or store those requests. See Responsible AI for details.
We welcome coordinated disclosure. Email admin@codegrid.dev with details and reproduction steps, or open a private advisory on the GitHub repository. Please give us a reasonable window to investigate and ship a fix before public disclosure. We aim to acknowledge reports within 3 business days.
CodeGrid is an independent, open-source desktop tool, not a SaaS platform — we hold no third-party compliance certifications (such as SOC 2), because we operate no servers and store none of your data. Our security model is transparency and minimalism: the less we collect, the less there is to protect. This page describes the current build and will be kept in step with the code.