Security by architecture
Trust the evidence, not a promise.
PAI's public platform is being designed around verified releases, constrained web services, local-first workspaces, and explicit permission boundaries.
Updates
Package first, manifest last
Release metadata is published only after its corresponding package and installer are available.
Integrity
Verified OTA
The desktop updater uses release metadata and package integrity checks before applying an update.
Secrets
Server-side credentials
Deployment, storage, signing, and CI credentials do not belong in browser JavaScript.
Privacy
Local-first workspace
Web services are being separated from ordinary local project access so connected features can have explicit boundaries.
Version 7 safety: PAI 7.1 is planned to add application-level behavior-based safety enforcement across planning, editing, execution, repair, and autonomous work. This page will be expanded as that implementation becomes testable.