Security
How Tapwah keeps people’s apps and accounts apart, and how to report a problem.
How it’s set up
- Sign-in. You sign in with Google or with a one-time code sent to your email. Tapwah has no passwords to leak. The app checks a signed session token on every request.
- One simulator per person. Each person building gets their own simulator while they use it. Chat, screen and taps never cross between people.
- Erased between people. Before a simulator is given to someone, it is erased, the previous app is removed and a self-test checks the sandbox. If the check fails, the simulator isn’t used.
- App sandbox. Each app runs in a sandbox that keeps it to its own files, stops it from starting other programs and blocks it from reaching our Macs. Apps can only connect out on the port used for secure web traffic (443), and the AI agent only builds apps that talk to Tapwah’s own backend.
- Limited AI agent. The agent that writes your app can only edit that app’s source files and build it. It can’t run commands on our Macs.
- Network. Our servers aren’t reachable directly from the internet. Traffic comes in through Cloudflare’s encrypted tunnel.
- This website. tapwah.com sets no cookies, loads nothing from other sites and runs no trackers.
Tapwah is new and we’re still adding protections. The next one is running the simulators under a separate macOS account.
Report a problem
If you find a security issue, email hello@tapwah.com with “Security report” in the subject. Tell us what you found and how to reproduce it. Please don’t access other people’s data or disrupt the service while testing, and give us a reasonable time to fix the issue before sharing it. We’ll reply and keep you posted.