Security & privacy

Where your code lives

Your projects live on your dedicated nodes: machines assigned to your company, not shared multi-tenant runtimes. Agent work executes there.

Authentication

• Passwords are stored as salted PBKDF2-HMAC-SHA256 hashes (260,000 iterations), never in plaintext.
• Two ways in: browser login sessions, or your company X-API-Key for programmatic access (see API access).
• Administrative functions require elevated roles; platform-level administration additionally requires an explicit admin mode, so an admin browsing normally can't trigger destructive actions by accident.

Agent guardrails

• Approvals: sensitive agent tools (shell execution, file writes, fleet dispatch, depending on mode) pause for your explicit approval; read-only modes cannot modify anything. See The Agent.
• Folder locks: tasks scoped to a project folder are serialized to a single node, so concurrent agents can't corrupt a project.
• Sandboxed execution: agent commands can run inside an isolation sandbox on the node when available.

Secrets handling

• Agent logs and transcripts pass through deep redaction: API keys, tokens, and credential-shaped strings are scrubbed before they're stored or displayed.
• BYOK provider keys are encrypted at rest with a key held outside the database.

Edge protection

The platform fronts every request with a scanner shield that blocks bot and vulnerability-scanner traffic (probes for .env, .git, admin panels, and known attack tooling) before it reaches the application.

Questions?

Security disclosures and questions: contact DENDAT support. For security-focused agent work (audits, vulnerability scans on your own projects), see the Cyber/Security agent mode.