Security
How Browlix protects your workspace
The controls in place today, the current limitations and how to report a vulnerability.
One permission decision
The web app, API, MCP and workers all ask the same permission function in the database. Hiding a button is not a control.
Secrets in a separate vault
Proxy passwords, data keys and connection credentials live in a secret vault and are released only to the command that needs them.
Machines have identities
Each machine has its own key; commands sent to it and updates are signed and verified.
Encrypted sync
Profile data is encrypted with authenticated encryption, bound to the workspace, profile and key version, before it leaves the machine.
Append-only logs
Every write returns a receipt; the audit log cannot be edited.
AI never sees secrets
The AI model never receives cookies, passwords or secret values; page content is treated as untrusted data.
Current limitations
What this version does not do yet, stated plainly so you can decide.
- Independent audit (SOC 2, ISO 27001)
- Not yet
- End-to-end encrypted sync
- No — the workspace key is managed by Browlix
- Code-signed Windows build
- Not yet; updates are still verified against the Browlix release signature
Report a vulnerability
Send it through the Contact page and choose the Security topic. Please do not disclose it publicly before we respond, and do not test against other people's data.