Security
No keys in the chat. No claims we can't back.
What Tofu holds and never holds, what your agent can do once you approve it, and exactly what the safety check reads before a deploy — with the limits written beside the claims.
- MAIL_API_KEYsecret••••Qm7xProdPreview
- SMS_API_KEYsecret••••c9d2Prod
- NEXT_PUBLIC_SITE_URLcornerbakery.orgProdPreviewDev
- DATABASE_URLmanaged••••••ProdPreview
Secrets are write-only — once saved, the value is hidden and never shown again.
- key
- "SMS_API_KEY"
- secret
- true
- value
- null
- preview
- "••••c9d2"
The value went to the hosting provider, write-only.
Some things never reach Tofu. So they cannot leak from it.
The most sensitive values stay with the service that owns them: your hosting provider, Google or GitHub, your DNS provider, Stripe.
Secret values
The value of a secret you save.
It goes straight to the hosting provider as a write-only value. Tofu keeps the name, the scopes and a masked preview; neither the dashboard nor Tofu can read the value back.
Passwords
A password for your account.
You sign in with Google or GitHub. When offered, you can also sign in with an emailed code or with your phone. None of these uses a password: Tofu never sets or stores one for an account that signs in this way, so there is none to lose.
Provider keys
A key or token pasted by you.
Nothing in Tofu asks you to paste one to connect a provider. Connecting DNS is an approval you give on the provider's own screen, and the credential that results is Tofu's to hold and to revoke. A model key you give a sandbox is an exception; see the note below.
Card numbers
Your card details.
You enter them on Stripe's own checkout page, and they never reach Tofu. Tofu keeps your plan and its subscription status.
Two exceptions, and both are yours. For a managed database, the owner-only Show the database key action rebuilds that string on request. Each call writes an audit line, no agent can reach it, and rotating the password is not built. In a sandbox, an API key you give it — under Your own key, or for Claude or Codex where offered — is saved in that sandbox only, and Tofu does not keep it.
Your agent acts for you. Only after you approve it.
A coding agent connects the way a TV app signs in: it shows a code, and you approve that code in your own browser, signed in to Tofu.
The setup message you copy carries the size and SHA-256 of the client and the skill, and asks your agent to check both downloads and to stop, running nothing, if either does not match.
tofu · login
Approve this sign-in in your browser. The code is
7F3A-C09B-21DE
Approve only a code your own agent printed.
Connect Claude Code (MCP)?
Check that this code matches the one in your coding agent:
7F3A-C09B-21DE
Your agent asks
The Tofu client in your agent starts a sign-in request and shows you a code shaped XXXX-XXXX-XXXX. The request lapses after 10 minutes.You compare, then approve
Open the approval page on the Tofu address you signed in to, and approve only if the code matches the one your own agent printed.It lasts 30 days
The client keeps the credential privately, bound to one Tofu address, and Tofu stores only its hash. Revoke it any time on the dashboard's Coding agent page — deleting local files alone does not.
What an approved connection can do
The full list, as the approval page shows it
This connection can upload your app’s source or import it from a public GitHub repository, download your app’s code into a new folder on your computer when the agent runs there, get the link that opens your app in Tofu’s builder, which you open yourself, run the safety check, deploy it — its build runs any migration step it has — once you have a hosting plan, save and remove your app’s public settings — an address, a feature flag, a key meant to be public — when the agent runs on your computer, but never a hidden value, which you type yourself in Keys & settings, create the app’s managed database, on its own or in the same call as a deploy, which Tofu runs and pays for as part of your plan, read the app’s build and runtime diagnostics, restore a previous deployment, connect, verify, release or withdraw the authorization for a domain you already own, read domain quotes and prepare a dashboard link for you to review a fresh price, agreements and payment when the agent runs on your computer — it cannot place an order or submit payment, read the stored status of domains you bought through Tofu and ask the registrar to send its confirmation email again to the registrant, without seeing your owner details or changing renewal settings, read and add DNS records on a domain you bought through Tofu, and delete one of yours — never its mail (MX) or verification (TXT) records, which stay with you, read your app’s own traffic — the first read for an app that has no counter yet issues its key — and turn that counter on or off, read whether your app is answering its visitors, and turn Tofu’s emails about it on or off, change how your app’s users sign in and how its sign-in email is sent, see who has an account in your app, add a person by email or remove one — which signs them out — choose whether anyone can sign up or only the people you add, and make the app private — only people with a link can open it — or open to everyone again, send a short message to up to ten of your app’s users, from your app’s own email address, get an invite link that lets one person into your private app — you hand the link out yourself, and the first person who opens it gets in for up to 30 days — list the links you made and turn one off again, choose who can open your app — anyone with the link, only people you list by email, or anyone with a code you share, which puts a sign-in page in front of the whole app — add or remove those people, make a new code, sign everyone out, and keep exact paths open for services like webhooks, connect your app to your own Stripe account when the agent runs on your computer — you install Tofu’s app on Stripe’s own page — then create payment links there, pass their payment events to the app or disconnect it, with the money going straight to you and nothing in its reach that moves money out of your account, set up email your app sends from its own address, pause it, give it a new key or remove it, when the agent runs on your computer — Tofu writes the app’s sending key into its settings, and nothing is sent until the app sends email itself, connect your app to Tofu AI or disconnect it, when the agent runs on your computer — Tofu makes the app its own key, which spends your account’s AI balance up to a monthly limit you can change, and writes it into the app’s settings without the agent ever seeing it, see your sandboxes and choose what model each one’s agent runs on — Tofu AI, which spends your account’s AI balance, or your own endpoint — and which agent its chat talks to, putting your own API key into that sandbox, when the agent runs on your computer, make your sandboxes, wake them, put them to sleep or delete them — which ends everything in one for good — and run commands in them and talk to their agents, which spends each one’s model budget, when the agent runs on your computer, make a new token for your own code to call a sandbox with, when the agent runs on your computer — it stops the token made before, the connection receives it (Tofu’s own tool on your computer keeps it in a private file, never in the chat), and it keeps working after you remove the connection, make a private test copy of one of your server apps to try a change on, put the version you tested there on the live app, or remove the copy and its database for good, when the agent runs on your computer — the copy takes test payments only, restore an archived database into a new one Tofu runs and pays for as part of your plan, and hand you a short-lived link to download its archive, keep a database Tofu warned you about from being archived for going unused, list your database’s daily backups and ask a person at Tofu to put it back to one, which loses what was saved after it, see which of your app’s database setup steps are done, choose whether Tofu runs them for an app, and mark one as done so it never runs, when the agent runs on your computer, delete an app — which also deletes its managed database, permanently, and the delete itself keeps no copy (a copy Tofu already holds of a running database, such as the archive it was restored from, is untouched) — or just its database; the source you uploaded is kept until you ask Tofu to erase it, send Tofu’s team a problem report you approved word for word, with your app’s status attached, sign in to Tofu, read the account’s id and email address, report the plan and the account’s GitHub state, and turn automatic updates off.
It cannot buy, renew or transfer a domain, submit a payment, read domain owner details, an environment value or a database password or connection string, change your plan or billing, or import a private repository from GitHub. Those stay with you.
Your agent acts on your instructions, and Tofu tells it to ask for your agreement before it puts an app online, adds a database, changes a domain, spends money, puts back an earlier version or deletes something. Tofu can’t see your conversation with it, so it can’t check that the agent asked: connect only agents and apps you trust, and disconnect any of them on the Coding agent page.
It says what it read. And what it did not.
Before a build, Tofu checks the exact files it is about to deploy. The promise is narrow on purpose: Tofu states exactly what it looked at, and never more.
Your agent calls
detectsetFrameworkscan
A tripwire before every deploy
A committed live key, a sign-in form that posts to another site or a seed-phrase collector stops the deploy, and so does a file that cannot be read. It runs on the exact files about to be uploaded.
Rules, not a model
Deterministic rules read the upload, from an exposed service key to known malware shapes. A finding that could harm other people blocks the deploy; a choice that only affects your own app is reported as a warning and never blocks.
Every result shows its coverage
How many files were read out of how many were given, which checks ran, and the list of risks no check looks for. That list is never empty.
A finding you can act on
Each finding names its rule and its file, says what it means, and carries a fix prompt you can hand straight to your coding agent.
- When nothing blocks, a result says
- No blocking finding among the checks that ran.
- When no file was read, it says
- Nothing was inspected, so this is not a pass.
Live only when it answers. The last good one stays up.
Health check
Checked before the address moves.
A finished build is requested at its own deployment address first. Your app's address moves to it only if it answers.
Failed builds
A failed build changes nothing live.
The previous version keeps serving. A database migration that fails inside the build fails it the same way.
Rollback
One step back, without a rebuild.
Rollback points your address at an earlier deployment that is ready and answering. Your data does not move back with it.
Where your data lives. Named, not implied.
A summary of the Privacy Policy, which is the full list — including how long each thing is kept and how to ask us to erase it. Read the Privacy Policy.
Visitors to your app. Counted, not tracked.
If you turn on Tofu's traffic counter for an app, it counts page views on Tofu's own endpoint, and the traffic is yours: shown in your dashboard, switched off from there, and used by Tofu for nothing of its own.
- No cookie is set in your visitor's browser.
- No third-party analytics script is added to your app.
- No IP address is stored.
- No full URL: the query string and fragment are dropped, the referrer cut to its hostname.
- Do Not Track and Global Privacy Control stop a view from being counted.
- Kept 90 days by default, never more than 365, and deleted with the app.
Found a hole? Tell us first.
Write to us with what you found and the steps to reproduce it. Please test only against your own account and apps, and give us a chance to fix it before you publish.
The same address is published in /.well-known/security.txt, where a researcher's tools look for it first.
Contact: mailto:hello@trytofu.ai Expires: 2027-09-27T00:00:00.000Z Preferred-Languages: en Canonical: https://trytofu.ai/.well-known/security.txt Policy: https://trytofu.ai/security#report
Coming soon.
A deeper, itemized security report. It is not built. The dashboard says so rather than showing example findings.
By design.
Not a malware guarantee. The safety check matches the shapes it knows, not intent. It does not look at what an app does once it runs, the contents of its database, or dependencies beyond the direct entries in
package.json.A connection is not per-app or read-only. An approved agent covers every app and operation your account allows. Revoke it on the dashboard's Coding agent page when you are done.
A checksum is not a signature. The pinned SHA-256 catches a mismatched or corrupt download. HTTPS from Tofu's own address is the trust boundary, so it cannot catch a compromised distribution server.
Log masking is best-effort. Tofu filters credential-shaped text out of the logs it shows, but it cannot read a write-only secret back to find every copy. An app must not print its own secrets.
Deleting an app keeps its uploaded source. The archive stays in private storage until you ask us to erase it.
No self-serve account deletion. Write to hello@trytofu.ai. Requests are handled by hand, and we tell you what was removed and what could not be.
No certification. Tofu is not SOC 2 or ISO 27001 certified, publishes no audit report, and does not claim GDPR compliance for the service.
Paste one message. Online in 10 minutes.
Your app, its database, your domain and your sign-in — from the agent you already use.