Security How Zenith handles your app

Built so a mistake can be undone.

Zenith changes production business apps, so it is designed around two rules: nothing is written without your approval of the exact change, and every function it pushes is snapshotted first so it can be restored.

  • Local first

    The mirror, drafts, threads and snapshots live on your Mac. There is no Zenith cloud to breach.

  • Your keys, your accounts

    Model keys are encrypted with your macOS Keychain and go only to that provider. Zoho access is your own session.

  • Writes are opt-in

    No app can be written until you allow it by typing its link name. Protected apps never can.

  • Every write is gated

    Preflight, a snapshot and a single-use ticket bound to the exact code you reviewed.

  • Undo is built in

    Roll back a run in one step. Rollback refuses to overwrite changes someone made after Zenith.

  • Nothing to track

    No analytics in the apps. Crash reports, if they ever exist, will be off unless you turn them on.

Data flowBring your own key

Your code never touches our servers.

Zenith runs on your Mac. It talks to Creator with your own session and to the model with your own key. Our server checks your license and sends update notices and safety switches; it never sees your code, prompts, model keys or Zoho cookies. See the privacy policy.

YOUR MAC

Zenith Desktop

  • Mirror of your app, drafts and snapshots
  • Model keys, encrypted with the macOS Keychain
  • Your Zoho session, kept on this Mac
Chrome extension (optional) talks to the desktop app on 127.0.0.1 only, after you confirm a pairing code on both screens.
Your sessionPull the app, push reviewed functions, re-pull to verify
Zoho CreatorYour data center, your account
Your keyYour prompt and the code in context, with secrets redacted first
Anthropic or OpenAIBilled to you at their prices
License and updatesLicense key, device id and app version. Update notices and safety switches come back
api.zenithsuite.ioZenith’s license server
Never sent to Zenith: your code, prompts, model keys or Zoho cookies. The app has no usage analytics.

Writing to your Creator app

  • Every app starts read-only. To let Zenith push functions to one app, you type that app’s link name; the permission covers that app and nothing else.
  • Apps on your protected list are never written, whatever else is set.
  • Before the first push, preflight checks Deluge lint, drift since the last pull and the target environment. A failed check blocks the run.
  • Each push needs a single-use ticket issued for that step. It is bound to the app, the function and a hash of the exact code you reviewed, and it is consumed even if the push fails.
  • Zenith snapshots each function immediately before changing it, and checks that a new function does not already exist before creating it.
  • Production targets, and apps without environments, need a typed confirmation and a review of every component.
  • Apps with environments ship as guided steps until Zenith has verified how each environment behaves.
  • A remote safety switch can turn off a Creator integration if Creator changes underneath it. It can only switch things off; a missing or unreachable configuration never enables anything.

Secrets in your code

  • API keys, tokens and passwords found in Deluge are replaced with placeholders before code is stored in a thread or sent to a model.
  • The real values are restored only at the moment code goes back into Creator, and never shown in the conversation.
  • Logs scrub provider keys, Zoho tokens and cookies, JWTs, and secret-looking query parameters.

The desktop app

  • The interface runs sandboxed, with context isolation and a strict content security policy. It cannot navigate away or open windows.
  • Creator pages load in their own browser partition with no access to Zenith’s internals. Only https Zoho pages are allowed there.
  • Model keys are decrypted in the main process for a single request to the provider’s own host, and never reach the interface or the logs.
  • Anything the agent reads from your app, a document or a web page is treated as data, never as instructions to Zenith. Pushes need your approval of the exact plan.

The extension and pairing

  • The extension talks to the desktop app on 127.0.0.1 only, and only after pairing with a code from the desktop app and a check confirmed on both screens.
  • Both sides prove they know the paired secret on every connection; the secret itself is never sent.
  • The desktop app can ask for a short list of named operations, never arbitrary code. Writing through the browser is off unless you turn it on in the extension.
  • Your Chrome session is handed to the desktop app only in answer to a request you started, after consent in Chrome and in Zenith, and only for the data center you chose.

Our server

  • api.zenithsuite.io handles licenses, device slots and update notices. It has no access to Creator and no model keys.
  • Licenses are signed leases the app verifies offline, so a server outage does not lock you out of work in progress.
  • Payments are handled by Lemon Squeezy; we never see card details.

Report a vulnerability

Email security@zenithsuite.io with the subject “Security report”. Include what you found, how to reproduce it and the versions involved. We will reply within three business days and keep you updated until it is fixed.

Please test only against your own Creator apps and accounts, and give us a reasonable chance to fix an issue before you share it.