How we think about security at Vorx

Security isn't a feature you bolt on - it's a set of defaults. That's doubly true for a platform like Vorx, where most of the people shipping apps aren't security engineers and shouldn't have to be. Our job is to make the easy path and the secure path the same path. Here's what that means concretely.

Isolated builds

Every project builds and previews in its own sandbox. One app can't reach another's files, environment or data - not by accident, not by a clever prompt. Isolation isn't a premium tier or a setting; it's the substrate everything runs on. When Vorx renders and tests your build, that happens inside the same boundary.

Safe by default

The apps Vorx generates come with the unfashionable parts included, and security is most of what's unfashionable: authentication, input validation, and access rules that follow from what the app is - if you asked for an app where foremen see their own jobs and managers see everything, that's enforced in the backend, not just hidden in the menu.

This matters because generated software changes who's shipping. When people who've never heard of an injection attack are deploying real apps, "the developer will remember to check" stops being a plan. The generator has to be the one that remembers - every time, by default, without being asked.

Verification helps here too. Before you see a build, Vorx signs in as a test user and clicks through the primary flows - which means the auth path isn't just generated, it's exercised on every single build. A broken login never reaches you.

Your data, your control

You can export a clean, standard repo of your app and take it anywhere. No lock-in, no proprietary runtime you can't leave, and no ambiguity about whose app it is: yours. We think the right to walk away is a security property - it keeps us honest, and it means trusting Vorx never has to mean surrendering to it.

The same goes for your data. It lives in a real database you can inspect and export, not a black box we summarise for you.

What we won't pretend

No platform gets to claim it's "secure" as a finished fact, and we're in early access - the honest framing is that security is a practice we're committed to, not a checkbox we've ticked. Defaults harden, the pipeline's checks grow, and we'd rather tell you what we do than sell you a padlock icon.

If you find something we got wrong, we genuinely want to hear it - get in touch. We'll keep writing about this as the platform grows, including the parts that aren't flattering.