Cuttlefish | Security Policy

1. Our Security Commitment

Security is foundational to Cuttlefish, not bolted on. We build with the assumption that an AI desktop application operates in a high-trust environment — your machine, your keys, your data — and we design every layer to protect that trust.

We welcome security researchers who help us find and fix vulnerabilities responsibly. This policy explains how we protect your data, how to report an issue, and what you can expect from us in return.

2. Five-Layer Defense Model

Cuttlefish protects you through five complementary layers. No single layer is relied upon in isolation, so a weakness in one is caught by the others.

1 Credential isolation at the operating system

Keys for models on your own machine are stored in your operating system's own secure keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service); keys for cloud model providers are stored encrypted by the Cuttlefish credential service. Credentials are protected in the applicable device or hosted store and used for authorized requests. Do not include credentials in shared configuration, conversations, or support reports.

2 Guardrail policy layer

Every action Cuttlefish takes is checked against your active rules before it runs. Anything that would cross a boundary you set — what it can reach, how far it can act on its own, what tools it may use — is stopped before it happens, and the decision is written to a tamper-evident record.

3 Tamper-evident record of every decision

Each protected action produces a cryptographically signed record of what was used, what changed, and who approved it. Those records are kept in write-once storage with long-term retention, and an independent check verifies each one. The result is a clear, trustworthy history you can review as plain proof.

4 Protected transport and infrastructure

All communication with our backend uses modern encrypted connections. The backend runs on managed cloud infrastructure with encrypted service-to-service communication and hardened, minimal server images that strip out anything not needed to run. This keeps the surface an attacker could reach as small as possible.

5 Sandboxed execution

Execution protections depend on the operation and environment. Contained code execution, approved project access, browser permissions, and desktop authorization have different boundaries. Organization policy and required approvals govern access; a permitted desktop or browser action is not the same as running every operation inside a sandbox.

3. API Key Security

Your API keys are the most sensitive data Cuttlefish handles. Here is exactly how we protect them:

Storage: Keys for models that run on your own machine are kept in your operating system's secure keychain — never in plain-text files or browser storage. Keys for cloud model providers you connect are held by the Cuttlefish credential service, encrypted at rest.
Transmission: Keys and requests travel only over encrypted connections. Requests to a cloud model provider are relayed by Cuttlefish's hosted service to the provider you chose, using your key.
Memory: A key is used only for the duration of the request that needs it, and is not kept around afterward.
Logging: API keys are never written to log files, crash reports, or usage diagnostics.
Backend: Moguls Inc backend services use a cloud provider key only to run the requests you make with it. The key is stored encrypted and is never shown to the models or apps you run. Keys for models on your own machine never reach our backend.

4. Auto-Update and Signature Verification

Cuttlefish includes a built-in updater so you stay current with security fixes. The update process is protected in several ways:

Signed updates only: Every update package is cryptographically signed. Cuttlefish verifies that signature before applying anything, and refuses any update that is unsigned or has been tampered with.
Encrypted delivery: Update details and files are fetched only over encrypted connections from our official release source.
You stay in control: You can review what an update contains before applying it from the Settings screen.
Safe recovery: Update verification rejects altered release packages. Installation and recovery depend on the operating system and installer; review an installation error before retrying and use the supported release or support path if recovery is needed.

5. Responsible Disclosure

If you discover a security vulnerability in Cuttlefish, we ask that you report it responsibly. Here is our process:

Report vulnerabilities to: security@getcuttlefish.app

Disclosure Response Targets

48-hour response target

We aim to acknowledge receipt of your report and assign a tracking identifier within 48 hours.

7-day assessment target

We aim to complete an initial assessment within 7 days and share available findings and an estimated remediation timeline. Confirmation depends on reproducing and assessing the reported issue.

Coordinated remediation

We target remediation within 90 days where feasible, with timing based on severity, dependencies, and safe verification. We coordinate public disclosure with you and prioritize issues being actively exploited.

What to Include in Your Report

A description of the vulnerability and its potential impact
Steps to reproduce it (a proof of concept if possible)
The affected component (desktop app, backend, or website)
Your assessment of severity
Your preferred contact method for follow-up

What We Ask

Do not publicly disclose the vulnerability before the agreed-upon date.
Do not access, modify, or delete data belonging to other users.
Do not degrade the availability of the service.
Act in good faith to avoid privacy violations and disruption.

6. Scope

This security policy and our responsible-disclosure process cover:

Cuttlefish desktop application — the desktop client for Windows, macOS, and Linux.
Cuttlefish backend — the backend services the desktop application connects to.
Cuttlefish website — getcuttlefish.app and app.getcuttlefish.app.

7. Exclusions

The following are out of scope for our responsible-disclosure program:

Vulnerabilities in third-party AI providers (OpenAI, Anthropic, and others) — please report these to the provider directly.
Social-engineering attacks against Moguls Inc employees.
Denial-of-service attacks.
Physical attacks against infrastructure.
Vulnerabilities in third-party dependencies that have already been publicly disclosed and have an upstream patch available (though we appreciate being told if we are running a vulnerable version).
Issues that require physical access to a user's machine.

8. Recognition

We value the security community's contributions. With your permission, we credit you by name or handle in our security advisories when your report leads to a fix.

We do not run a paid bug-bounty program. We ask you to report responsibly because it protects the people who use Cuttlefish, and we recognize good-faith research in kind.

9. Contact

For security vulnerabilities and concerns:

Security Team
Email: security@getcuttlefish.app

For general legal inquiries:

Moguls Inc
Email: legal@getcuttlefish.app
Support: support@getcuttlefish.app
Web: https://getcuttlefish.app

For details on how we handle your data, see our Privacy Policy and Terms of Service.