Security

Bristle's security posture is mostly a consequence of its architecture: there is no back end to breach and no database of user data to steal.

How your credentials are handled

• API keys and OAuth tokens are held in your browser's local storage and are sent only to the provider they belong to.
• They are never transmitted to us, never written to a log, and never included in an error report.
• Key fields are masked in the interface, and a provider can be removed at any time from Settings.
• GitHub Copilot sign-in uses the OAuth device flow, so no long-lived password is ever handled. The short-lived Copilot token is refreshed automatically and discarded when it expires.

The two proxied requests

GitHub's authentication endpoints refuse cross-origin browser calls, so two requests are forwarded by a serverless function on our host. That function is restricted to an explicit allowlist of exactly those endpoints — it cannot be used as a general proxy — and it stores nothing.

How your images are handled

Decoding, analysis and rendering all happen on your device using WebGPU or WebGL2. The only copy that leaves is the reduced-size version sent to your chosen model provider so the agent can see what it is painting.

Application hardening

• Model output rendered in the chat is parsed and sanitised before it reaches the page, so a response cannot inject script.
• The site is served over HTTPS only, as static assets with no server-side rendering of user input.
• Third-party dependencies are kept to a small, audited set.

Reporting a vulnerability

If you find a security issue, please report it privately through the contact form on deb0.com before disclosing it publicly, and allow reasonable time for a fix. We welcome good-faith research and will not pursue action against researchers who act responsibly.