Treat instructions as data until they earn trust.
Retrieved pages, files and tool output can contain hostile instructions. Miton scans input, records injection signals and keeps the permission policy responsible for the final action.
Know what
you’re allowing.
Decide what Miton can access and which actions need your approval. A hosted model receives the context you send it; a local model runs on your hardware.
Read the permission guide →Security details reviewed 17 September 2026.
What stays local. What may leave. Who decides.
- Project data
- Local
- Project files, conversations, goals, workflows and local indexes live on the machine running Miton.
- Model requests
- Your chosen boundary
- A hosted model receives the context required for a turn when you allow that provider. A local model keeps inference in its local process.
- Provider keys
- OS-backed secret storage
- Bearer tokens and model credentials stay out of localStorage and plaintext application state.
- Diagnostics
- Off
- Usage sharing, crash reports and response feedback are independent controls and remain off until enabled.
- Beta access list
- Encrypted first-party record
- The site stores an HMAC index and AES-GCM ciphertext in D1, without IP, browser or tracking fields.
- OAuth connection tokens
- OS-backed store + transient exchange
- Long-lived access and refresh credentials stay in the client OS-backed credential store. Brokered exchanges, refreshes and revocations are transient and do not become ordinary provider API traffic.
The privacy defaults are part of the interface.
Every diagnostic gets its own switch. Local media processing is named as such. Learning prompts require approval. Permission modes and project trust decide what tools may do before a write begins.
- Diagnostics
- Usage sharing, crash reports and response feedback have separate controls and remain off until enabled.
- Learning prompts
- Proposed project knowledge is shown for approval before Miton keeps it.
- Project trust
- Permission modes and workspace trust decide what tools may do before a write begins.
Consent belongs to the provider. Credentials belong to you.
OAuth connections are for third-party integrations, not Miton account sign-in. You approve provider-specific scopes in the system browser, and Miton stores the resulting credential in the client’s OS-backed credential store.
Read how OAuth connections work →- Direct native flow
- GitLab · Linear · Slack · Google · Cloudflare
- The client opens the system browser, completes a PKCE-protected authorisation flow and receives the callback locally.
- Brokered confidential flow
- GitHub · Bitbucket · Notion · Figma
- A dedicated Miton broker performs the confidential exchange and returns a short-lived protected result for the client to save locally.
A network request should leave a trace.
Supported WebView and Rust request paths feed an egress ledger. The completeness guard checks both surfaces so “audited” does not mean “we searched one half of the app”.
Trust improves when action is reversible.
Project changes can be reviewed, permission prompts remain explicit and rewind gives a way to restore files. Restoring files cannot undo an API call, a database write or another change outside the project.
Responsible disclosure
Report privately. We will investigate openly.
Do not open a public issue for a suspected vulnerability. Emailsecurity@miton.dev. Include affected versions, reproduction steps and impact. Miton aims to acknowledge a report within 48 hours and coordinate disclosure after a fix is available.
Include affected versions, reproduction steps and impact so the report can be triaged.