Security
How Tapwah keeps people’s apps and accounts apart, and how to report a problem.
How it’s set up
- Sign-in. You sign in with a one-time code sent to your email. Tapwah has no passwords to leak. The app checks a signed session token on every request.
- Your own seat. Each person building gets their own simulator while they use it. Chat, screen and taps never cross between people.
- A clean simulator every time. Before a simulator is given to someone, it is erased, the previous app is removed and a self-test checks the sandbox. If the check fails, the simulator isn’t used.
- A sandbox for every app. Apps run in a sandbox that keeps them to their own files, stops them from starting other programs and blocks network access.
- A fenced-in AI agent. The agent that writes your app can only edit that app’s source files and build it. It can’t run commands on our Macs.
- No open doors. Our servers aren’t reachable directly from the internet. Traffic comes in through Cloudflare’s encrypted tunnel.
- This website sets no cookies, loads nothing from other sites and runs no trackers.
No system is perfect, and Tapwah is new. We’re still adding layers, such as running simulators under a separate macOS account.
Report a problem
If you find a security issue, email hello@tapwah.com with “Security report” in the subject. Tell us what you found and how to reproduce it. Please don’t access other people’s data or disrupt the service while testing, and give us a reasonable time to fix the issue before sharing it. We’ll reply and keep you posted.