Security
How we think about security
RoBuild doesn't have user accounts or stored project data yet, so there's nothing to disclose about production incidents today. These are the principles the platform is being built against.
Row-level data isolation
Once accounts and projects exist, every database table enforces Row Level Security — a user can only read or write data they actually own or are a member of.
Secrets never reach the browser
API keys for AI providers, payments, and the database admin role are read only in server-side code and are never bundled into anything sent to your browser.
AI changes are reviewed, not automatic
Generated changes land as a proposal you accept or reject. RoBuild is designed to never silently overwrite a file in your project.
No unlimited usage
Every AI endpoint will be rate-limited and credit-metered server-side, so no plan — including paid ones — offers literally unbounded usage.
Found a vulnerability?
Email us directly — there's no bug bounty program yet, but every report is read and taken seriously.