Security and trust
Built so that a mistake stays small
Code written by AI can have mistakes, like any other code. LazyFrog is designed so that one app's mistake can't spread, and you can always go back.
Isolation
- Every project runs in its own sandbox, with its own network, databases and storage. Projects can't see each other.
- AI assistants never get a server login. They use LazyFrog's tools, which reach only the projects you allow.
- Published sites live on lazyfrog.app, a separate domain from LazyFrog's own, so a problem on one site can't reach your account.
Data
- Hosted in Germany. Databases, files and snapshots are encrypted at rest.
- Snapshots every hour for the last day, then one a day for the rest of your plan's undo history, and one before every risky change. Projects on a paid plan are also backed up regularly to a second location, encrypted, and we test restoring from those backups.
- Your code is kept in git and everything can be exported, so your data is never stuck with us.
Secrets
- Secrets are stored encrypted and separately. They're never shown back, and only your app can read them.
- When your AI needs a key, you paste it into a LazyFrog page, so it never passes through the chat.
- Commits containing keys are refused, and logs are cleaned of keys, tokens and card numbers before they are written.
Monitoring
- A built-in scan checks for common security mistakes and suggests a fix for each.
- The live site is checked against what was published. A change made outside a publish alerts you and us.
- Outbound traffic from free apps is limited to common services, and abuse is stopped.
- Free accounts have no live site, only a preview that search engines don't list, and a published site that looks like phishing is flagged for review.
Before your app goes live
What to check in code an AI wrote, and which of those checks the scan does for you: the security checklist for AI-built apps, with a real scan before and after.
Status and incidents
Whether LazyFrog is working right now, 90 days of history for each part of it, and every incident with its updates are on the status page, where you can also get them by email.
Reporting a vulnerability
Use the security report form with what you found and how to reproduce it. We confirm we've received it and keep you informed until it is fixed.
Please don't access other people's data, degrade the service, or test against sites you don't own. Our disclosure policy sets out the rules and what we commit to in return. See also the list of sub-processors.