Push44 is designed with a privacy-first, client-side zero-backend architecture:

• No Central Server: All network calls originate directly from your browser, terminal, or Android device to official platform endpoints (Base44, Rocket.new, Floot, Zite, GitHub).
• No Remote Database: User API tokens, GitHub Personal Access Tokens (PAT), and project snapshots are stored exclusively in the user's browser localStorage or device app sandbox.
• Zero Telemetry / Zero Tracking: No analytics trackers, no session loggers, and no middleman proxies.

We take the security of Push44 and our users' credentials seriously. If you discover a security vulnerability, please do NOT open a public issue.

Please report vulnerabilities privately via GitHub Private Security Advisories.

• A description of the vulnerability.
• Steps to reproduce the issue (proof of concept code or cURL requests).
• Impact assessment.

• We will acknowledge receipt of your report within 48 hours.
• We will provide a timeline for fixing and verifying the vulnerability.
• Once resolved, we will publish a security advisory giving appropriate credit.