Elyra
 Elyra The coding agent e The native code editor Elyra Grove Native local development environment Askr The real server for Laravel & PHP Elyra Framework Rust + Svelte 5 framework for desktop apps Elyra Conductor Local project conductor Elyra SQL Server MySQL-compatible SQL server in Rust Elyra SQL Client Native desktop SQL workbench Elyra SQL Anywhere Replication-ready SQL engine Elyra Sjá SEO & GEO workspace for macOS Elyra DataGrid Server-driven data grid for Laravel
Start here
Overview
Getting started
Features
Using Sjá
Settings
Licensing
Reference
Architecture
Security & privacy
Release notes
Changelog
Elyra
Elyra
Elyra Sjá
Security & privacy

Security & privacy

Local-first

Projects, analyses, crawls, monitors, and history are stored locally in SQLite, under ~/Library/Application Support/Elyra Sja/. Nothing is sent anywhere except:

  • the pages/sites you analyze (fetched directly),
  • Google PageSpeed Insights, if you enable Performance,
  • your chosen AI provider, when you use Run with AI,
  • elyracode.com for update checks.

Secrets in the Keychain

The AI API key, the PageSpeed API key, and the license code are stored in the macOS Keychain (service com.elyra.sja), never in the SQLite database. On save they are written to the Keychain and blanked in the DB; on load they are read back from the Keychain. A legacy value found in the DB is migrated to the Keychain on the next save.

Data retention

History is capped at startup so the database can't grow without bound: the 20 newest runs per URL and the 20 newest crawls per project are always kept, older ones past 90 days are removed, alerts are capped at 500, and space is reclaimed (VACUUM) only when there is a meaningful amount free.

The AI file sandbox

When the AI agent edits code, its file tools (list_dir, read_file, write_file) are sandboxed to the project's local code path. Paths are canonicalized — which resolves symlinks — and rejected if they land outside the root, so a symlink inside the project cannot be used to reach e.g. ~/.ssh. .git, node_modules, target, and dist are skipped when listing. With Ask before the AI writes files enabled (default), every write pauses for a preview and explicit approval, and times out rather than waiting forever.

There is currently no in-app undo for AI edits — keep the project under version control (git) so you can review and revert diffs.

Updates

Auto-updates are ed25519-verified: the downloaded artifact must verify against the public key embedded in the app before it is applied, so a compromised release host still cannot push a malicious binary.

Distribution integrity

Release builds are signed with a Developer ID certificate, run with the hardened runtime, and notarized + stapled by Apple — so Gatekeeper verifies them offline. Releases include SHA-256 checksums.

Exported reports

PDF/HTML exports can contain client data, so they are written to an owner-only (0700) directory under Application Support — not the shared /tmp — and pruned after a day.

Reporting

Do not put API keys, license codes, private URLs, or client data in public issues. Report security concerns privately to the maintainer.

Back to docs