Safety and Security

This page explains Jr. Studio's safety model in plain language. It separates controls the app enforces from limits that still require adult judgment. Jr. is designed to reduce risk; it does not promise that AI output or local software is completely safe.

What goes where

1. On your computer: projects, project-local images, prompts and activity, versions, settings, usage counters, transaction journals, and verified starter-catalog cache files.
2. To your selected AI provider: when you start an AI run, the official Claude Code or Codex CLI can send the request and project context it reads to that provider under your account.
3. To the release and catalog hosts: ordinary HTTPS update requests, which may expose IP address, time, app version, platform, and user agent but do not contain your account, project, prompt, or an installation identifier.
4. To support: only the email and material you deliberately send. Jr. may generate a small aggregate beta report or a failure-specific diagnostic report locally, show it in full, and open a prepared support email; nothing is sent automatically.

Jr. creates no installation identifier and runs no background product analytics. Public GitHub release-asset counts are aggregate downloads, not users or unique installations.

Controls Jr. enforces

Local application boundary

The app server listens on the local loopback interface, rejects non-local Host and Origin values, and requires a random session token for API requests. This reduces exposure to websites and other network devices; it does not protect against software already running with your macOS- or Windows-account privileges.

Transactional project changes

AI providers edit a staged project copy. Jr. validates file types, paths, file counts, sizes, network references, image rules, and a hidden rendered preview before replacing the live project. A failed, stopped, timed-out, rejected, or broken run is discarded. A small journal supports recovery if the app stops during the final directory swap.

Versions and restore points help undo accepted changes. They are convenience history, not a substitute for a separate backup.

Scoped provider execution

Jr. starts official provider CLIs in the staged project directory with available workspace restrictions. Claude is limited to project read/write/search tools; shell and web tools are disabled. Codex is requested to use its workspace-write sandbox without interactive approvals. Jr. checks required CLI safety capabilities and refuses a run when the expected controls are unavailable.

Provider CLIs remain separate software and require network access to their AI services. No application-level sandbox can be described as an absolute security boundary against every provider or operating-system defect.

When you explicitly choose Generate image, Jr. asks Codex to use its built-in image-generation capability. The description is processed by OpenAI under the connected Codex account, the result is copied into the staged project, and the run counts against the account's Codex usage. Jr. does not require a separate API key for this built-in path.

Preview network and runtime checks

Project previews use a Content Security Policy that blocks network connections, remote frames, forms, plug-ins, and remote media. Local project images and data URLs are allowed. Candidate previews are rejected for load failure, runtime errors, unhandled promise rejections, blank output, renderer failure, or timeout.

File and image policy

Projects accept a small allowlist of text files. Project-local assets are PNG or JPEG only, with verified encoded type and dimensions, safe flat names, and per-file, count, and total-project limits. SVG, GIF, WebP, HEIC, remote imports, malformed images, traversal paths, and other project files are rejected. The upload picker may decode other image formats supported by the local browser and convert them locally to PNG or JPEG before upload. Formats the device cannot decode, commonly including HEIC on some systems, are rejected with an error.

ZIP export contains active project files only. It excludes application settings, provider files, snapshots, transaction journals, and absolute paths.

Platform distribution and starter updates

Packaged macOS releases are signed and notarized. During the invite-only Windows beta, the Windows installer and UAC recovery helper may be distributed unsigned with a prominent download-page warning. Windows can identify an unknown publisher, show a SmartScreen warning, or block the app with Smart App Control. Only install an unsigned beta obtained from the exact getjr.app release link after comparing its published checksum. Remote starter catalogs are accepted only after Ed25519 signature, schema, version, hash, authoring-rule, and project-policy checks. Installation is atomic, and Jr. falls back to the previous verified or bundled catalog after a failure.

These are release requirements. Verify the published build and release record; draft source code alone is not evidence that a specific download passed them.

Daily runs and Workspace Rules PIN

The daily run limit blocks additional real-provider runs after the configured count. It limits run starts, not tokens, provider charges, or usage from another app.

An optional Workspace Rules PIN can reduce casual shared-screen changes to sensitive settings. PIN recovery asks macOS system authentication or launches the packaged Windows helper through UAC. An unsigned beta can show an unknown-publisher UAC warning. Credentials stay inside the operating system; success authorizes only the PIN reset. The PIN does not encrypt projects, secure the operating-system account, or protect against the logged-in owner.

What Jr. does not enforce

• Jr. does not pre-moderate every prompt or generated result.
• Jr. cannot guarantee that generated code is correct, appropriate, original, accessible, or free from security defects.
• Jr. cannot control provider retention, model behavior, account eligibility, organization-administrator rules, plan limits, or API pricing.
• The daily run limit is not a spending cap.
• Preview network blocking does not block the provider CLI, software updater, or signed starter-catalog client from reaching their required origins.
• Local files may be read by the macOS or Windows account owner, authorized software, backups, or malware with sufficient privileges.
• The optional PIN is not parental-control software, identity verification, or a defense against the computer owner.
• Jr. does not replace adult supervision, a backup, endpoint security, or review before a project is published or shared.

Safer household use

• The adult account holder should connect and manage the provider account.
• Review prompts and files before starting a provider run.
• Keep private names, contact details, secrets, credentials, and sensitive images out of prompts and projects unless you intentionally want the provider to process them.
• Use provider privacy controls appropriate for your account.
• Review the "What changed" result and test the preview after each AI edit.
• Export or separately back up work you cannot replace.
• Stop a run and contact support if the CLI requests unexpected access or Jr. reports a safety failure.

Reporting a safety or security issue

Stop using the affected project and preserve the app version and error message. Do not email credentials, access tokens, or unnecessary personal information.

Security, privacy, and legal reports: legal@getjr.app

Product support: support@getjr.app