6cript writes code on your behalf. We treat that responsibility seriously. This page is the live posture, not a marketing claim.
Owner-scoped projects
Every project, blueprint, schema, scene, task, and preview is bound to its owner via row-level security. The application server never trusts a client claim about ownership; the database enforces it.
Read-only previews
Public preview URLs go through a service-role client that loads only the project bound to the token, and only in read mode. The visitor cannot insert, edit, delete, or chat. They cannot see other projects belonging to the owner, the export buttons, or owner controls.
No raw secrets in the UI
Integration cards track environment-variable names and a "secret configured" toggle. They never accept or display raw API keys. The export package excludes secrets by construction.
Checkpoints
Schema-changing AI moves snapshot first. If something looks wrong, restore the previous checkpoint. See the Checkpoints article for the contract.
What we are honest about
- Custom domains are not shipped — preview URLs live on 6cript.
- Multiplayer collaboration is on the roadmap; today every project is single-owner.
- AI providers see your prompts. Provider TOS apply to those calls.
- Production deployment automation (CI / CD) is not part of the launch tier.