Security
Metroit X’s agent can read files, write files, and run commands on your own machine — so we treat the safety layers around that capability as core product, not an afterthought. Here’s what’s in place today.
Encrypted in transit
All traffic between your device, our backend, and the Plugin runs over encrypted connections (HTTPS/WSS).
Salted password hashing
Passwords are hashed with bcrypt and a per-user salt. We never store or see plaintext passwords.
Revocable sessions
Logging out immediately invalidates that session token server-side — it can’t be replayed even if it leaked.
Scoped workspace access
The Plugin only operates inside the folder(s) you explicitly connect — not your entire disk.
Command safety checks
A multi-layer permission engine reviews commands before they run, flagging or blocking destructive patterns (recursive deletes, force-pushes, disk-level operations, and more).
What we don’t do
We don’t sell your data, run ads, or use third-party tracking cookies. We use your files, code, and command output only to generate the response you asked for; the AI provider you select processes them under its own terms — see our Privacy Policy for the full picture.
A note on limits
Our permission engine is a best-effort safety layer, not a guarantee — always review what the agent proposes before approving destructive actions on a machine you care about. See our Disclaimer.
Found a security issue? Please report it responsibly to info@dremora.co — we’ll respond as quickly as we can.