Software is being produced faster than ever with AI coding tools. We use them every day — this platform was built with them. But that speed can introduce duplicate code patterns, recurring security gaps, and AI-mediated functions that quietly drift. That's why every Krystalize release goes through independent scanners and, yes, real humans.
Our founders have been users, architects, coders, and contributors to real, launched, currently-used software platforms — we are not tossing something out to "see what sticks." Krystalize is a thoughtful, secure, user-centric platform that actually works and doesn't drift, because it uses actual deterministic code to manage the local and cloud AIs and deliver the experience that should be part of everyone's everyday AI.
These are observational proofs you run on your own machine — not cryptographic guarantees, and that honesty is the pitch. We hand you the instruments instead of asking for trust.
A bundled script tails Krystalize's entire process tree and prints every outbound connection in real time. Match what you see against our published egress manifest — nothing else should ever appear.
Grep the installed bundle for every behavioural analytics SDK — Segment, Amplitude, PostHog, Mixpanel, GA. The answer is zero, and it stays zero.
From 0.15.19 the macOS shell links Sentry for crash reporting. It is the only thing in Krystalize that talks to a server we don't own, it fires only on a crash or hang, and it reports from the native window/process shell — not the engine. Your mail, contacts, files and crystals live in the local server, which is not instrumented in shipped builds. sendDefaultPii is off, so no IP address is attached. Grep for it and you will find it: we would rather name it here than have you discover it.
Everything Krystalize knows about you lives in one SQLite file on your disk. We hand you the exact command to open it and read it — plain text, your eyes, your machine.
Nothing enters memory without "Krys wants to remember: X → you approve." Even local capture is consented and visible. No silent writes, ever.
Our code is clean. Every release is put through an independent SAST, dependency, secret, supply-chain, and quality gauntlet. The local tools are free and reproducible by anyone; results are pinned to the exact commit they ran against. The cards below cover our first-party source. Bundled third-party components we ship are assessed separately — see the disclosure beneath them.
Each card opens its Polaris report — the full scan, its exact reproduction command, and the SHA-256 of the raw output, as a downloadable PDF.
GitHub's semantic code analysis — taint tracking, injection, unsafe patterns across first-party source.
Pattern-based static analysis (p/security-audit) over first-party source — injection, unsanitized sinks, dangerous APIs.
Scans the tree for committed credentials, tokens, and keys — scoped to first-party source.
Aqua's multi-scanner over dependencies, secrets, and misconfiguration.
Google's advisory-database scan of our actual resolved lockfile — the authoritative dependency-CVE check for what we ship.
Anchore's vulnerability match against the first-party dependency set.
Behavioral analysis of dependencies — install scripts, obfuscation, malware, protestware — cross-referenced against our resolved lockfile so rollup false-positives don't count.
Dead-code and duplicate-pattern analysis — the direct measure of "no slop." Maintainability graded on every release.
Every card above reads 0 unresolved. 38 alerts remain on the record across five independent scanners, and every one carries a published, specific reason — read them in full inside the scanner's own PDF, not summarized here.
kind: inSource, status: accepted in the SARIF with a written justification published alongside it — dataflow findings whose queries define no applicable barrier, so no code change can clear them (e.g. "OMLX_HOST is hard-coded http://127.0.0.1:<port>, the loopback-bound local model — keeping file content on-device is the point of local-first inference, not an exfiltration path"). The CodeQL CLI does not honor in-source suppressions at all, so we implemented that pass ourselves — and it fails the build if any suppression lacks a justification, so a bare marker can never silence an alert.osv-scanner.toml. Two are advisories against xlsx: both were fixed upstream (0.19.3 and 0.20.2) and we ship 0.20.3. They still match because SheetJS stopped publishing to npm, so the advisory record encodes introduced:0 with no fixed version and cannot represent the patched CDN build we actually install — a broken record, not a live exposure. The third is the react-router advisory below..grype.yaml and .trivyignore.yaml: the same react-router-dom advisory (GHSA-qwww-vcr4-c8h2), independently. No fixed version exists — the advisory names 8.3.0; the latest published on npm is 7.18.2. The vulnerable RSC request handler is not in the shipped bundle: this GUI is a client-only Vite SPA on plain <BrowserRouter> with zero RSC surface. Grype's own report keeps an audit trail of the acceptance (ignoredMatches); Trivy's does not, so the reason lives only in the ignore file and its PDF. Drop all three entries — this one, and its twin in OSV above — the day 8.3.0 ships.socket-accept.json. Every one describes third-party package behavior, not our code — a native pty compiling at install (node-pty, the Terminal widget's dependency), minified build output in a bundler's own dist/ (vitest, drizzle-orm, five others), a types-only package with no executable code at all (@types/sanitize-html), a recent npm ownership change on the IMAP client we pin by exact version and lockfile hash (imapflow). No first-party code change clears a behavioral flag on a package we did not write — the ledger is the only honest mechanism, same as the other four.Krystalize does not redistribute the AGPL messaging stack. Scan the shipped installer for the Matrix bridges (mautrix-imessage, -slack, -telegram, -whatsapp) and the Dendrite homeserver and you get zero hits — none of it is inside the app. Messaging is an opt-in runtime component: if you turn it on, it downloads to your own machine — the same pattern as the bundled AI CLIs. Enabling it installs AGPL-licensed software locally, and we say so plainly; the oMLX local-AI runtime is fetched the same way, by your choice. Neither is redistributed inside a commercial product.
What actually ships is our own application — the first-party code scanned clean above — plus the AI CLIs and the Node.js runtime. Bundled runtimes carry upstream advisories we don't author; we scan the shipped artifact and disclose them rather than bury them. A bundled Node.js CVE with no upstream fix is accepted and re-checked on every Node bump, never silently shipped.
Still outstanding, and stated rather than implied: CodeQL's Swift database has not finalized on recent runs, so the native (Swift) layer is not yet covered by SAST.
Also in the stack, running off the commit-mirror on every push: DeepSource (JS · Python · secrets · shell), Qodana (JetBrains quality), and Corgea (AI SAST, CWE-classified). Raw SARIF / CSV outputs back every card above — every report is regenerated per release and stamped with the app version and commit SHA, so what you read matches the build you are running, not a stale marketing artifact.