Security and privacy

M1rror is built so that a design decision, an implementation and a test result can each be checked on their own. The security page explains the controls in detail; this section covers what matters day to day.

• Your workspace is yours. Workspace scope comes from your session on the server, never from the request. Unknown or other workspaces' items simply return not found.
• People approve. Agents draft; approvals, build authorisations, pull requests, billing and membership changes are human decisions.
• Approvals bind to what was reviewed. A changed design means a new release and a new review.
• Your code isn't run on the control plane. Scans and pull request checks read your repository without running it.
• Your content isn't used to train AI models. Repositories, references and captures are private to your workspace by default.

More detail:

• Data and privacy: exports, deletion and retention.
• Account security: two-factor authentication and sessions.