Security features
Encryption, secure input cards, hardline command blocks, URL guards, sensitive-screen protection and app integrity.
- Encrypted secrets – provider keys, search keys, web server password, saved logins, workspace secrets and SSH credentials are sealed with Android Keystore-backed keys.
- Secure input cards – passwords, OTPs, cards and API keys are entered in cards "Secured by Chandail X", never in chat. CX never asks for your UPI PIN.
- Approvals – side-effecting tools ask first; submit and JavaScript browser actions always ask.
- Hardline blocks – catastrophic commands never run, whatever you allow.
- Sensitive content detection – the browser's security check flags sensitive controls and prompt-injection signals on pages.
- MCP URL guard and header redaction – sensitive headers (Authorization, API keys) are redacted in logs and tool output.
- Path safety – file tools refuse system folders and other apps' sandboxes; zip extraction rejects
../paths. - Hide sensitive screens – FLAG_SECURE on sign-in and API-key screens.
- Archive lock – password + biometric lock for archived chats with auto-lock.
- Local data ownership – data created by another account stays locked when someone else signs in.
- App integrity – CX AI requests are signed and checked, and the app verifies its own integrity.
- Safe mode – if the app crashes repeatedly on start, a Safe Mode screen lets you recover.