Local-first by design
Lasso runs beside your development server and is designed to keep project files in your local environment. Changes are proposed as reviewable diffs so you can inspect them before writing to disk.
Access controls
Authenticated API requests use signed, secure session cookies. Workspace and team operations are checked against the current user and workspace membership. API keys are stored as protected credentials and should be rotated if exposed.
Transport and infrastructure
Production web and API traffic should use HTTPS. Lasso Host supports secure local development domains for browser capabilities such as microphone access. Database and provider credentials are kept in server-side configuration and are never intended for client bundles.
Responsible disclosure
If you discover a security issue, please avoid public disclosure until we have had an opportunity to investigate. Send a private report to security@lasso.byorello.space with steps to reproduce and the potential impact.
