Form writes code and runs a compiler. Here is how that is contained.

Code Form writes is never trusted

Everything a model returns is checked before Form does anything with it. Source file paths must stay inside the project, must be Swift, must not duplicate, and the whole app has a size limit. A reply that fails any of those checks is refused rather than saved or compiled.

A model never chooses which program runs, what arguments it gets, where the build happens, what the app is called, or how it is signed. Those are fixed by Form.

Compiling happens in a sandbox

The Swift compiler runs inside a macOS sandbox profile that denies network access and blocks writes to files outside that one build's private directory. Each build gets a fresh directory with restrictive permissions, and a build that is cancelled or times out has its whole process group terminated.

This is process isolation, not a virtual machine. A process that deliberately escapes its process group is outside that boundary.

Apps Form builds are sandboxed too

Every generated app is signed with the macOS App Sandbox enabled. It can reach files you choose through an open or save panel, and it can make outbound network requests. It cannot read the rest of your disk.

Apps are signed for you, on your Mac, so they run where they were built. An app you export and send to a colleague will need their permission to open, because it is not signed by Apple as a distributed application — only Form itself is.

Keys and secrets

There is no AI key in the Mac app. Generation runs on Form's own model account behind Form's service, and the app authenticates with your session rather than a secret you hold. There is nothing to paste and nothing to leak from your machine.

Form instructs the model never to write a credential into an app it generates, and to ask you for one at runtime instead.

What a generation may cost you

Every generation checks your remaining credits with the billing provider before it starts — never against a figure Form remembered — and charges only what the work actually cost. A request that fails, or a model that cannot be reached, is not charged for.

Each attempt carries its own identifier, so retrying after a dropped connection settles the same charge rather than creating a second one.

Your account and your data

Sign-in uses a one-time code by email. Sessions are held in the Keychain, refreshed in a way that cannot resurrect a session you signed out of, and every request to Form's own service is HTTPS with redirects refused.

Your apps are kept with your account so they survive this Mac, and the database enforces ownership at the row level: one account cannot read or change another's projects, messages, versions, or usage. A client cannot forge an assistant message, a version's source, a build result, a usage record, or an app's stored settings — those are written on your behalf by Form's service, bound to the account it verified, and 106 assertions run against a real database on every change to check it.

What is not covered

No external penetration test has been carried out and no threat model has been published. Form is small and says so rather than implying assurances it has not earned.

If you find a security problem, please report it privately through support rather than publicly.