Clear safeguards. Honest boundaries.

Your account

Accounts use an email address and a password of at least 12 characters, verified with a code sent to your email. Passwords are handled by Supabase Auth through Appsanic's server and are never stored by Appsanic itself. An existing account can also sign in with a single-use link sent by email.

Sign-in is protected by a bot challenge, request limits and origin checks, and sessions are kept in HttpOnly cookies that page scripts cannot read. Password resets use a separate, short-lived proof that grants no access to your projects.

• Every workspace is personal and owner-only on every plan.
• Sign-out revokes the session at the provider, not just in your browser.
• Google and GitHub sign-in are not offered yet and are labelled that way.

Your projects

An app is one description, and every change to it, from the canvas, from code or from Sanic AI, goes through the same validation. A change that breaks the rules is refused whole, so a project is never left half-updated. Each accepted change is saved with a revision number, so a stale edit cannot silently overwrite a newer one.

Projects, their history and Sanic AI conversations are saved to your account. You can export a project at any time, and delete a project or your whole account. Deletion is permanent, asks for explicit confirmation, and removes documents, code, conversations and connection settings.

The code your app runs

Your app's source is never executed inside the editor or on the server that compiles it. The browser preview runs a compiled bundle in a sandboxed frame with its own opaque origin, a content security policy and a validated message bridge, so it cannot reach the editor, your account or other sites.

The compiler restricts what the bundle may import, and preparing a library runs bounded checks rather than package install scripts. Native packaging has its own compatibility checks. None of this replaces reviewing the code and dependencies you choose to use.

Connectors and keys

Connectors hold public configuration only: a project address, a publishable key, an App ID, a search-only key. Private and service keys are refused. Your published app talks to each service directly; Appsanic hosts no credentials for it and relays none of its requests.

The editor's connection check reads a service's public metadata through a bounded inspection and never reads your users' data. Test and Live configurations are stored separately.

• Never paste secrets into chat, source files or uploaded assets.
• Give each connected service the least access your app needs; its own policies protect the data.
• Keep privileged operations on your own backend.

Sanic AI

The AI provider's key stays on Appsanic's server. Connector fields marked sensitive are withheld from Sanic AI's context and filtered from its tool results, so it can see that a service is connected and what it can do, but not the values you entered. If a request needs a service you have not connected, it asks you to connect it in the editor rather than in chat.

Each request sends the project context it needs, such as the current page, your selection and relevant files, to the provider. Sanic AI prepares changes in a private draft and they reach your project only after validation and compile checks.

What this page is not

It describes boundaries that are implemented. It is not a security certification, and it does not promise that an app you build is secure: your app's access rules, the services it uses and the code you add remain your responsibility.

Phone testing, signed builds, store submission and hosted Sanic AI are still being switched on for the hosted site. Each will be described here when it is.

Report a concern

If you have found a potential vulnerability, write to us privately with the affected area, what you observed and safe steps to reproduce it. Please avoid live credentials, other people's data and testing that disrupts anyone else's work.

Opens your email app with the subject “Appsanic security report”.