Security

Last updated: August 14, 2026 · Benge Software LLC

The Privacy Policy covers what data MakeItOurs handles and who it goes to. This page is the technical detail behind it: exactly how your AI provider keys and GitHub tokens move over the network and where they sit at rest.

Transport-layer baseline

MakeItOurs makes no exception to the OS's HTTPS-only default (App Transport Security on Mac and iOS): every request is plain URLSession with full system certificate validation. There is no custom trust handling anywhere in the app and no code path that could bypass or weaken TLS.

AI provider API keys

Fetching the list of models available to your key talks to each provider over a hardcoded https:// endpoint. The key itself always travels in a header, never a URL — Authorization: Bearer for OpenAI, OpenCode Zen/Go, OpenRouter, Groq, xAI, DeepInfra, and Mistral; x-api-key for Anthropic; and x-goog-api-key for Google. No provider request puts a credential in a query string, where it could end up in a server log.

When MakeItOurs runs OpenCode locally on your Mac, your key is passed to the OpenCode process as an environment variable — never a command-line argument, so it can't leak through a process list. That local control server binds to 127.0.0.1 only, with a fresh random password generated at every launch; it is never reachable from off your device.

GitHub tokens

GitHub's OAuth device flow sends client_id, device_code, and refresh_token in a POST body, never a URL, over https://github.com. Every other GitHub API call is routed through one shared request path with a hardcoded https://api.github.com endpoint and the token carried in Authorization: Bearer — there's no separate, hand-rolled request that could skip that path.

Uploading an AI provider key to GitHub as a repository Actions secret is the one place GitHub itself demands more than TLS: the app fetches your repository's public key and encrypts the credential on your device with libsodium sealed-box encryption before sending it. GitHub's servers receive only ciphertext they can't read — that client-side encryption sits on top of TLS, not instead of it.

At-rest storage

Tokens and keys live in the OS Keychain, device-only by default (no sync). They only sync via iCloud Keychain if you explicitly opt into trusted-device sync — and that sync channel is itself end-to-end encrypted by Apple, not something MakeItOurs implements or could weaken.

Net result

Every credential-carrying path in the app — AI provider requests, GitHub OAuth, GitHub API calls, and the one place GitHub requires more than TLS — uses standard, unmodified system transport plus the specific extra encryption each provider's own API requires. Nothing here relies on a server we run: the credential either stays on your device, or travels encrypted, directly to the provider it belongs to.

Questions about any of this? Reach out from the Support page.