Security

Zodic is designed around reviewed packages, isolated execution and account-bound access. These controls reduce risk; no system or AI output can be guaranteed completely secure.

Reviewed execution

Creator packages pass source, manifest, dependency and runtime checks before publication. Tasks use reviewed package versions in isolated runtimes with constrained tools, network access and resource limits. A workflow references the same reviewed specialists rather than modifying their source.

Credentials and account separation

Firebase authentication identifies the account. Protected operations verify identity and email ownership on the server. Purchase entitlements and execution access are server-authoritative. Personal provider keys are handled by the trusted credential gateway; creator packages do not receive raw keys. Saved keys use authenticated encryption; session keys are temporary. Removing a referenced key never authorizes a silent switch to another provider credential.

Operational controls

Production deployment requires HTTPS, restricted service credentials, private durable package storage, bounded capacity and tested key/runtime recovery. Deployment-specific checks must pass before public launch. This page does not claim a security certification, independent audit or verified live infrastructure that has not been established.

Report a concern privately

Email zodic0744@gmail.com with a concise description and safe reproduction details. Never send a real API key, password or another user's data.

General product support: Discord.