TRUST / DATA FLOW
Know what moves.
Keep the reins.
Veasel Code runs its server locally and stores session history in SQLite. Model prompts are sent to the provider configured by the person running the server. Local storage does not mean local inference.
YOUTerminal clientloopback HTTP
→LOCAL MACHINEV server + SQLitesession history
→YOUR CONFIGURED PROVIDERModel APIprompt and recent context
Current protections
- The backend binds to loopback; remote server binding is not implemented.
- Provider credentials stay in the backend environment and are not returned by the API.
- Remote model endpoints require HTTPS; local development endpoints may use loopback HTTP.
- Provider redirects are rejected, and response sizes and message counts are bounded.
- New sessions accept an existing workspace directory and store its canonical path.
What to keep in mind
- Your model provider receives the prompt and conversation history needed to answer.
- The loopback API has no application token; other programs running as your user may reach it.
- The saved workspace path is not yet a file-access sandbox because file tools are still in development.
- Plugin package validation is experimental. MCP processes, plugin approvals, and Skill execution are not available.
- The official mascot artwork carries a noncommercial license; commercial distribution needs separate permission.