Security, in practice.

Use the project’s download service or published GitHub releases. Match the installer to your operating system and architecture, and keep the app and your operating system up to date.

Review the release information for the version you install. Desktop builds currently use the Axle project name.

Agents can work with files and run tools according to the capabilities and permissions available in their environment. Review proposed actions and code changes before relying on the result.

Grant connected apps the access they need for your task. Be especially careful with production environments, organization accounts, and services that can publish or modify shared information.

Keep provider API keys and other secrets out of repositories, prompts, screenshots, and shared logs. Revoke or rotate a credential with its provider if it is exposed.

Use the security controls available on your device and provider accounts. Your selected models, connected services, and remote environments each have their own security boundaries.

Check the repository’s Security tab for the current vulnerability-reporting options before sharing sensitive details. Keep private data and credentials out of public reports.

For a non-sensitive bug, include the app version, operating system, steps to reproduce, and a description of the expected result in a GitHub issue.