Security model.

Security model

Rabbit IDE is a desktop application that runs on your machine. The editor itself has no telemetry endpoint and no cloud code index. Your code is sent only to the model endpoint you configure — a local model, your own provider key, or the optional Rabbit Cloud proxy tied to your account.

API key storage

Provider API keys are stored locally in your IDE configuration on your machine. They are never synced to our servers and never logged. Moving key storage into the operating system keychain (Keychain Services, Credential Manager, libsecret) is on the roadmap; until then, treat your local configuration directory as sensitive.

Network access

Rabbit IDE makes outbound HTTPS requests only when:

• Calling a model provider (local server, Anthropic, OpenAI, etc.) with your key
• Using the optional Rabbit Cloud proxy with your account token
• Checking for application updates
• Downloading VS Code extensions from Open VSX or the marketplace

There is no analytics SDK and no crash reporter in the editor. Air-gapped operation is supported with local models.

Cloud account data

If you create an account for cloud routing, we store your email, password hash, balance, subscription state, and per-request usage (model, token counts, cost) needed for billing. We do not store your prompts or code.

Reporting vulnerabilities

If you discover a security issue, email security@rabbit.dev. We aim to acknowledge reports within 48 hours.