No telemetry
Veyra doesn't collect usage data. Your projects never touch our servers, and you can use the editor without an account.
Secret-safe AI
The assistant never picks .env files, keys, credentials, gitignored files or files containing tokens. Attaching one yourself needs a deliberate second Send.
No API keys in the app
The AI provider key stays on the veyraeditor.com server and never reaches the app. Veyra keeps only a revocable sign-in token in a private file in its app data folder.
Strict Content Security Policy
The interface can only run Veyra's own code and only talk to the extension marketplace. Injected or remote scripts are blocked.
Signed updates
Every update is signed, and installed copies verify the signature before installing anything.
Gated, public releases
Releases are built by GitHub Actions from the open-source code, and only after tests and dependency audits pass.
INDEPENDENT AUDIT · OCTOBER 2026
What the audit found, and what we did
A read-only review of the website, release process and desktop app reported ten actionable findings. None were exploited vulnerabilities, but every one was real. All are fixed or have a documented decision, shipped in Veyra 0.6.1.
The fixes found two more problems along the way: a vulnerable dependency inside one language tool, and a Find & Replace bug. Both are fixed too. Read the story in How Veyra keeps your secrets out of AI prompts.
| Finding | Area | Status |
|---|---|---|
SEC-01 | Content Security Policy | Fixed: strict policy, tested in production builds |
PRIV-02 | Secrets in AI context | Fixed: excluded by name, .gitignore and content |
REL-03 | Signing wording | Fixed: accurate trust panel on the download page |
REL-04 | Version consistency | Fixed: versions come from the release itself |
CI-05 | Release test gates | Fixed: tests and audits must pass before building |
SUP-06 | Install scripts & advisories | Fixed: no install scripts; dependencies audited |
DOC-07 / 08 | Size and Node.js claims | Fixed: generated from real release files |
REL-09 | App identifier | Decided: migrate once at 1.0, with tests |
What's signed, and what isn't yet
We'd rather tell you than have your operating system surprise you.
| Control | Status | What it means for you |
|---|---|---|
| Update signing | In place | Updates are verified by Veyra before they install. |
| SHA-256 checksums | Published | Compare your download with the checksums on the download page. |
| Windows publisher signing | Coming | SmartScreen may warn on first run: choose More info → Run anyway. |
| Apple notarization | Coming | Right-click → Open the first time on macOS. |
Report a vulnerability
Please report security issues privately through GitHub's security advisories, not public issues. We aim to respond within a few days.
Report privately →Read the full audit response
Every finding, the exact change and how it was verified, in the open-source repository.
Open on GitHub →Private by design. Free to use.
Veyra is open source, has no telemetry, and keeps your code on your machine.