Skip to content
Start free

Xodia security: how your code, secrets and previews are protected

Each Xodia project previews in its own isolated container with no open internet. Secrets are encrypted at rest, your AI connects with OAuth and keeps its own login, and your code stays in your own git repo. This page says what Xodia does today, and what it doesn't claim.

Start freeHow Xodia works

Free plan. 14-day Pro trial. No charge unless you choose a plan.

Settings, Environment: two preview variables shown only as hidden, the note that values are encrypted and never shown to your agent, and the one extra host this preview may reach.

Sandboxed previews

Every preview in its own container

A preview runs your site's own dev server, which means running its code. So every preview runs apart from the others, and its network is closed by default.

Preview sandboxOne isolated cloud container per project, with no direct internet. It sleeps when nobody is using it.
Allow-list proxyEvery request leaves through Xodia's proxy, over HTTPS only. Tokens are added here, so they never enter the container.
  • Allowed:This project's own repository, with a short-lived token for that one repository
  • Allowed:Package registries for npm and Yarn, the few prebuilt binaries some packages download, and Google Fonts
  • Allowed:The CMS your project uses, detected for you, and any host you add yourself
  • Allowed:For a built-in AI run, the model API with a token that only works while that run lasts
  • Refused:Everything else, including other projects' repositories
Where a preview's requests may go. Anything not on the list is refused.

Secrets

Secrets encrypted, and kept from your AI

Host tokens, Cloudflare and analytics credentials and your preview's environment variables are encrypted at rest with AES-256-GCM, each tied to its own record.

  • Only for the dev server

    Environment variables go only to your preview's dev server, never to your AI.

  • Never shown again

    Once saved, a value is shown as hidden, in Xodia and to your AI. You can replace or remove it.

  • Hosts you allow

    You choose which extra hosts a preview's server may call, beyond the ones Xodia detects.

Roles and permissions

Pro and up

Decide who can publish, invite and connect

With team roles, the workspace owner sets the lowest role that may create or delete projects, publish to live, invite members and manage connections.

  • Owners can always do everything, including billing and deleting the workspace
  • Admins help run the workspace; team roles come with Pro and Agency
  • Members work on projects and do what is set to all members
  • Without team roles, every member can create, delete and publish, and admins and owners invite and manage connections

Roles and permissions: who may create and delete projects, publish to live, invite members and manage connections, with Delete projects and Publish to live raised to admins and owners, and what Owner, Admin and Member mean.

More protections

Your code, your AI and your account

The rest of what Xodia does to keep your site and your account safe.

  • Your code in your repo

    Xodia's GitHub App only sees the repositories you pick. Saves are commits with just your changes, and unsaved work is kept in a private copy, never pushed to your branch.

  • OAuth for AI apps

    AI apps connect to Xodia's MCP server and sign in with OAuth. Your AI's own login never comes to Xodia, and the tools can't publish your site.

  • Drafts out of search

    The editor, previews and drafts tell search engines and other crawlers not to index them, and the app's robots.txt keeps crawlers out.

  • Protected sign-in

    Sign in with email and a strong password, GitHub or Google. Sign-up, sign-in and password resets are checked for bots.

  • Browser protections

    The app refuses changes that don't come from Xodia itself, can't be framed by other sites, and is served over HTTPS only.

  • Previews on your own Cloudflare

    Pro and Agency can run previews in their own Cloudflare account instead of Xodia's, with Xodia installing the runtime there. What stays in your account

Honest limits

What Xodia doesn't claim

Xodia is new. It doesn't hold SOC 2 or any other security certification yet, doesn't offer a choice of data region, and has no uptime guarantee. We will say so here when that changes.

The services Xodia uses to run, and what each one receives, are listed in the privacy policy.

Found a security problem?

Please tell us before you tell anyone else. Send what you found and the steps to reproduce it, and leave other people's data alone while you look.

Report a security issue

Keep exploring

Related pages

Edit your site safely.

Start freeSee pricing