AppifexAppifex

    Security at Appifex

    What we do with your code, where your data lives, how secrets are handled, and the security that ships inside the apps we generate.

    Your code

    Every project is committed to a private GitHub repository. With repository access connected, that repository is created in your own GitHub account and remains yours, including after you close your Appifex account. Appifex generates standard React, React Native, Swift, Python and SQL — there is no proprietary runtime to be locked into and nothing to export.

    Your data

    Each project is provisioned its own PostgreSQL database rather than sharing one. Feature-branch work runs against an isolated schema and is merged into production only when you publish, and generated apps pin the schema on every connection so one branch cannot read another's rows.

    Your secrets

    Environment variables and API keys are encrypted at rest with Fernet before storage, with a separate key protecting GitHub access tokens. Sensitive-looking values are masked in the interface and require an explicit confirmation to reveal or download. Known credential patterns are redacted from logs. Shared platform deployment credentials are never injected into your build environment.

    A real backend, not keys in the client

    Most AI builders generate a front end and stop there, so the app talks to a database or a third-party API straight from the client. Two things follow from that, and neither is a matter of coding carefully: the API keys ship inside the app where anyone can extract them, and the rules about who may read or write data are enforced by code running on a device you do not control. Appifex generates a real FastAPI server with its own PostgreSQL database and file storage. Secrets stay on the server, authorization is enforced on the server, and the database is never exposed to the client. It is a structural difference, so it holds whatever else the app does.

    Security inside the apps we generate

    Native Swift apps ship with Apple's App Attest, which lets your backend cryptographically verify that a request came from a genuine, unmodified copy of your app running on real Apple hardware, along with request signing and runtime detection for jailbroken or compromised devices. This is infrastructure most AI code generators omit entirely — the usual output has no security dependencies at all.

    Questions

    Who owns the code Appifex generates?

    You do. Every project is committed to a private GitHub repository. If you have connected GitHub with repository access, the repository is created in your own account and stays there — including after you delete your Appifex account. There is no proprietary runtime and no export gate.

    What GitHub access does Appifex need?

    Appifex needs permission to create your project repository, push generated code, open pull requests and register webhooks. If you would rather not connect GitHub, Appifex will create and host the repository on the platform instead, and you can move it to your own account later.

    Where does my project's data live?

    Each project gets its own PostgreSQL database, provisioned per project rather than shared between customers. Work on a feature branch runs against an isolated schema, and that schema is merged into your production schema only when you publish. Generated applications set the schema on every database connection, so a branch cannot read another branch's data.

    How are my API keys and environment variables stored?

    Environment variables and API keys are encrypted at rest with Fernet (AES-128-CBC with HMAC) before being written to the database, and GitHub access tokens are encrypted with a separate key. Values whose names look sensitive are masked in the interface, and downloading them unmasked requires an explicit confirmation. Known credential patterns are redacted from logs.

    Which AI providers see my code?

    Code generation runs on OpenAI models by default. Anthropic and Google models are used for specific features. Your prompts and the code being worked on are sent to those providers to produce output.

    Is an Appifex app more secure than one from other AI builders?

    Structurally, yes, and the reason is the backend. Most AI builders generate a front end and stop, so the app talks to a database or a third-party API directly from the client. That means API keys ship inside the app where anyone can extract them, and the rules about who may read or write data are enforced by code running on a device you do not control. Appifex generates a real FastAPI server with its own PostgreSQL database. Keys stay on the server, authorization is enforced on the server, and the database is never reachable from the client. That difference is architectural, so it holds regardless of how carefully the rest of the app is written.

    Do the apps Appifex generates include security of their own?

    Yes, and this is unusual for AI-generated code. Native Swift apps ship with Apple's App Attest, so your backend can verify a request came from a genuine, unmodified copy of your app on real Apple hardware, along with request signing and runtime checks for compromised devices. Most AI code generators produce apps with no security dependencies at all.

    Related reading