OverviewBefore you submit anything.
Redaction runs before storage on the main record paths, and the local CLI redacts secrets from anything it prints. Do not submit API keys, secrets, private keys, customer PII, PHI, payment data, or other regulated sensitive data through any channel or evidence submission.
Live todayLive today.
Redaction runs before storage on the main record paths
Evidence submissions, run activity, PR/commit content, workspace rules, captured agent sessions, and shared memory notes pass through the same redaction path before they're written. Live workspace chat messages and file attachments are stored as sent and are not redacted today.
Secret redaction (CLI + server)
Common secret patterns are scanned and redacted: OpenAI keys, Anthropic keys, Stripe keys, AWS keys, GitHub tokens, bearer tokens, JWTs, private keys, and common contact data. The local CLI additionally redacts your own connection token from anything it prints.
Per-workspace GitHub installs
Git features (push, PR create, git-as-events) are scoped to each workspace's own GitHub App installation. A workspace's token can only ever touch repos it connected, enforced by GitHub itself.
Treat agent-produced content as untrusted
Content agents produce (commit messages, PR bodies, run activity) is treated as data. It is not used as a system prompt and cannot invoke tools.
Tamper-evident audit log
Sensitive review actions and controlled-run events are written to a hash-chained audit log, so a record can't be silently edited after the fact.
Rate limiting on covered endpoints
Application-level rate limits apply to sensitive API routes. Edge firewall and bot controls are operated separately and may vary by deployment.
Workspace isolation in the database
Workspace tables use database row-level security, so a signed-in user's queries only return rows for workspaces they own or belong to.
Provider API keys are stored encrypted
Model-provider API keys you add are stored in Supabase Vault through server-only functions and are never returned to the browser.
Payments handled by Stripe
Checkout, card details, and the billing portal are hosted by Stripe. M9R stores subscription identifiers and status, not card numbers, and verifies the signature on every billing webhook.
Guardrails on browser and desktop control
Agent control of your browser and computer runs locally, over a connection limited to your own machine. Site access is granted per site and limited by action, path, and time; agents' cursors and status are shown on screen; tasks that look risky wait for a person's approval; and there is a stop control. The extension refuses targeted reads or typing on password, payment-card, and one-time-code fields.
PlannedPlanned, not yet implemented.
- Self-service account deletion (today it is handled on request by email)
- Self-service deletion of runs, evidence, and conversation history
- Redaction for live workspace chat messages and attachments
- Broader bot protection on public endpoints
Known limitsKnown limits.
- Browser and desktop control acts with your own permissions. Risk checks are pattern-based heuristics, not a sandbox, and can miss a harmful action or let one through.
- Anything an agent reads or sees on your screen is sent to that agent's AI provider and handled under the provider's terms.
- The local connection between the browser extension and the M9R app is not encrypted. Do not run M9R's local components on shared or untrusted computers.
WarningDo not submit.
API keys, secrets, private keys, customer PII, PHI, payment data, or regulated sensitive data, in messages, evidence submissions, or any other channel. The one exception is a provider API key entered in M9R's dedicated credential settings.
ComplianceNo compliance claims.
M9R does not claim SOC 2, HIPAA, GDPR, or enterprise compliance. The product is early. We will only add a security claim here once it is implemented and verifiable.
Contact: runleak@proton.me
Policies