Counterfact protects your agent's files.

The CLI reads your files locally

The local CLI reads your agent's files on your machine. When it sends file contents off your machine, it sends them to the sealed relay operated by Counterfact. The relay forwards model requests, including those contents, to Anthropic.

The web console receives your sign-in token, repository facts, and a list of files with sizes. Repository facts include the remote URL, branch, commit, folder, and whether there are uncommitted changes. The console also saves the findings, which quote lines of your code.

This describes analysis with the local CLI. If you connect GitHub in the web console, Counterfact reads your repository on its servers. The privacy policy covers both paths.

Files that look like secrets are skipped

The CLI skips secret-named files, including .env, private keys, and credential files. It also scans the contents of every file it would send and skips any file containing what looks like a key or token. It tells you which files it skipped and why.

The relay runs in confidential hardware

The relay runs in Google Cloud Confidential Space on a Confidential VM with Intel TDX. The processor encrypts its memory and protects its integrity against a malicious host.

Secure boot is required, and debugging is disabled from boot. Confidential Space launches 1 container image, identified by its fingerprint, with no operator login. The relay's root filesystem is read-only.

The CLI verifies the relay before sending file contents

Google's attestation service signs a token stating the hardware, boot state, and container image fingerprint. The CLI verifies that attestation against its pinned image fingerprint before sending any file contents. Google Cloud KMS restricts use of the encryption keys to that image. The analysis instructions are sealed with encryption, and only the relay can open them.

The relay's source is public in counterfact-labs/sealed-relay under the Apache-2.0 license. Anyone can run its reproducible build to get the exact image fingerprint the CLI pins. The CLI's source repository is private, and its npm package is UNLICENSED.

Every pull request is checked with Semgrep static analysis.

An analysis charges your balance

An analysis charges your prepaid balance in 1 click. There is no separate price confirmation. Prices are listed on the top-up page.

Vulnerability reports

Email hello@counterfactlabs.com with the subject "Security report". Include steps to reproduce and the affected version. We confirm receipt within 2 business days and keep you updated until it is fixed.

Research guidelines

Please do not access other customers' data, disrupt the service, or publicly disclose before we have had a chance to fix it.

Safe harbor

We will not pursue legal action against good-faith research that follows this page.