Security

Last updated: 2026-10-02

AI Product Builder is designed so your code and credentials never need to reach it. It offers read-only planning and review tools, and nothing more.

What it cannot do

• It cannot access your local files or run commands.
• It cannot deploy software, delete data, spend money, publish anything, or send messages.
• It does not need your repository, secrets, or personal data.

Sign-in

• Only signed-in Orbittly accounts that include the AI Product Builder can use it. Your AI assistant signs in through orbittly.com, where you approve it; the assistant never sees your password.
• Every request must carry a short-lived access token (1 hour) that orbittly.com signed for this service. The service checks the signature, issuer, audience, expiry, and access before doing anything, and refuses the request otherwise.

How the guidance is protected

• The service's complete private rules are never loaded into your AI assistant. It receives only the short guidance needed for the task at hand.
• That guidance is fetched by the service from a private repository and checked for structure and integrity. It is used only if every check passes. If a check fails, the service stops and returns an error instead of guessing.

Reporting a security issue

Email info@orbittly.com with what you found and how to reproduce it. Please do not include credentials or confidential source code.