Security
Powerful bots, on a short leash
BotLegger's bots can read your mail, run commands, and act on your accounts. Here is how it keeps that power in your hands.
Your data
Your data stays on your devices
Conversations, memories, tasks, and workspace files live on your device or a server you own. Normal chat never passes through a server we operate. When a bot uses a cloud model, the conversation goes to the provider you chose.
Keys in your system's credential store
API keys and account tokens are kept in Apple Keychain, Windows Credential Manager, Linux Secret Service, or Android Keystore-backed encryption. The app only ever shows the last four characters.
An account that knows almost nothing
The BotLegger account is optional. It holds only your email and the devices you signed in on. Your bots, chats, and keys never reach it, and error reports are sent only if you turn them on.
A browser that stays in its lane
The bot browser keeps the sites you sign in to in its own profile on your device or cloud computer, out of reach of file tools, sandboxed commands, and backups. Bots ask before they open a new site or click and type on one, and every request a page makes is checked, so sites cannot reach your home network or the computer itself.
You decide what happens
Asks before it acts
Before a bot sends, creates, changes, or deletes anything through a connected account, a card in the chat says in one plain sentence what it wants to do and waits for Allow once, Always allow, or Deny. No answer in 10 minutes denies. Always allow covers one bot, one tool, one kind of action, and one destination.
What bots read cannot give orders
Web pages, emails, documents, files, and tool output reach the model marked as outside content. Once a turn has read any, changes to a bot's memory, tasks, and skills ask first, and standing approvals are confirmed again.
Relayed messages cannot prompt you
Replies started by Discord, Telegram, Slack, WhatsApp, email, or another bot raise no approval prompts. They can use only what you already set to Always allow, and are refused everything else.
Only you write the rules
Rules go into every bot's instructions, so no bot can create, change, or delete one. Bots can still write skills, but only with your approval each time.
Mistakes stay contained
Access tiers for commands
Every bot starts at Ask before commands: each shell command is shown in full and runs only if you approve it. Run commands safely confines commands in the macOS or Linux sandbox, hiding SSH keys, cloud credentials, and browser profiles. Full access is only for a bot you would hand your terminal to.
Python with no way out
Bots run Python in a WebAssembly sandbox inside the app, the same on every platform: no network, no other programs, and only the files its rules allow.
An audit log bots cannot touch
Commands, outside file writes, outbound actions, approvals, and bot changes are recorded in each bot's Activity, stored where no bot can read or edit it.
Built carefully
macOS releases are signed and notarized. Dependencies are checked for licences and known vulnerabilities, and the full history is scanned for leaked secrets before every release.
Contact support
Need help, or found a security problem? Email support@botlegger.com. For a security problem, say what you found and how to reproduce it; we aim to acknowledge reports within 3 business days. Please allow 90 days for a fix before you disclose an issue publicly. Our contact details are also in security.txt.
For what BotLegger collects and why, read the privacy policy.