Security

Security and privacy at Assumer

You decide what the agent can read, run and change. Here is how Assumer keeps your code and your machine safe.

Runs on your machine

The agent reads and edits files locally in your project. Nothing is changed outside the directories you work in unless you allow it.

Permission prompts

Every tool can be set to allow, ask or deny, with rules for specific shell commands. Risky commands stay behind your approval.

Reversible changes

Each change is tracked, so you can review the diff and undo any step with /undo.

Account sign-in

Sign-in uses a device flow in your browser. No passwords are stored in your project files.

Encrypted in transit

Requests between the CLI, the desktop app and the Assumer service are sent over HTTPS.

Protected server mode

When you run assumer serve, protect it with a username and password before exposing it on a network.

Set the rules in your project

Commit a permission policy to the repository so every developer and every agent session follows the same rules.

assumer.json

{
  "permission": {
    "edit": "ask",
    "bash": {
      "git status": "allow",
      "npm test*": "allow",
      "rm *": "deny",
      "*": "ask"
    },
    "webfetch": "deny"
  }
}

Responsible disclosure

If you believe you have found a security vulnerability in Assumer, email security@assumer.in with steps to reproduce. We will acknowledge your report, keep you updated on the fix and credit you if you wish.

Frequently asked questions

Does Assumer upload my whole repository?

No. The agent reads files on your machine and sends the parts it needs for the current task (for example the files it is working on and command output) to the model through your Assumer account.

Can the agent run commands without asking?

Only commands you allow. Each tool and shell command pattern can be set to allow, ask or deny, and every file change can be reverted with /undo.

How do I report a vulnerability?

Email security@assumer.in with the details. Please do not disclose the issue publicly until we have had a chance to fix it.

Where can I read the privacy policy?

See our privacy policy and terms.