Current security model
The free preview runs as a local Node.js MCP process. It reads supported source files and Git metadata from the repository opened by the user. The preview does not require an account or send repository contents to a LunaForge service.
Data handled locally
- Supported source-file paths and contents for import resolution.
- Git history required by TimeTravel and Autopsy.
- Architecture policy rules supplied by the user.
- Generated graph, impact result, and receipt files.
Website data
The launch website records limited aggregate events such as install-button clicks, path, country code supplied by Cloudflare, and timestamp. The pilot form forwards information only when submitted. When no private webhook is configured, the form opens the user’s email client instead.
Not currently claimed
LunaForge does not claim SOC 2 certification, GDPR certification, end-to-end encryption, perfect semantic analysis, or verified performance at a specific repository size.
Command execution
The preview’s code-intelligence tools analyze and report. They are not intended to execute arbitrary shell commands or autonomously edit code. Cursor remains responsible for agent actions, and users should review proposed changes.
Report a vulnerability
Email security@lunaos.ai. Include affected version, reproduction steps, and impact. Do not include sensitive third-party source code.