Security

Security is central to Shellway — it lives in your terminal, alongside your credentials, tokens, and production systems. Here's how we think about it and what we do to keep your data safe.

What Shellway sends to AI models

When you run sw <prompt>, Shellway sends to the AI:

• Your prompt
• Recent shell output you've explicitly included (via sw --context flag, or the lines Shellway captures with your permission)
• Your current working directory path
• Your config.toml system prompt, if set

Shellway does not read your environment variables, .env files, SSH keys, or shell history unless you explicitly paste that content into your prompt.

What we store

Our servers store:

• Your account email and hashed password
• AI turn counts per day (for rate limiting)
• Session timestamps
• CLI version reported on first run

We do not store the content of your AI conversations or shell output. Each request is processed and discarded. Anthropic (our AI provider) applies their own data retention policies to API calls.

Authentication

• API keys are stored locally in ~/.shellway/credentials with file permissions 0600
• Keys are never sent in URL parameters — always in request headers
• You can rotate your API key at any time from the dashboard
• Sessions expire after 30 days of inactivity

Transport security

• All communication between the Shellway CLI and our servers uses TLS 1.2 or higher
• Requests to the Anthropic API are made server-side, not directly from your machine
• We enforce HSTS on all our domains

Infrastructure

• Hosted on AWS with private networking between services
• No direct database access from the internet
• Secrets managed via AWS Secrets Manager
• Regular dependency audits and automated vulnerability scanning

Responsible disclosure

If you discover a security vulnerability in Shellway, please report it to us at security@getshellway.com before disclosing publicly. We'll acknowledge your report within 48 hours and aim to resolve confirmed vulnerabilities within 14 days.

Please include:

• A description of the vulnerability and its potential impact
• Steps to reproduce or a proof-of-concept
• Your contact details (optional, but helpful for follow-up)

We don't have a formal bug bounty programme yet, but we recognise responsible researchers publicly (with their permission) and will work with you to credit your finding.

Contact

Security disclosures: security@getshellway.com
General enquiries: hello@getshellway.com