Security
GenieLabs exists to read code you would rather not send anywhere. This page states exactly what happens to what you paste, so you can decide whether to use it.
Where your code goes
When you press run, the contents of the editor are sent over HTTPS to a relay on this site, and the relay forwards it to the model provider configured for the deployment. That is the only destination. There is no third-party analytics service, no session recording, and no error-reporting tool that captures request bodies.
The relay exists so that provider credentials never reach your browser. It also normalises two different stream formats into one, caps the size of each request, and rate limits by address.
How long it exists
Input and output live in the page. Drafts are written to your own browser's local storage so a refresh does not lose your work, that copy stays on your device and is never transmitted until you run a request.
Requests are not written to a GenieLabs database. Identical prompts sent within the same hour may be served from a short-lived in-memory cache; that cache holds response text only and expires.
- In the page: until you clear it or close the tab.
- In local storage: until you clear the draft or clear site data.
- In the relay cache: up to 30 minutes, response text only.
- At the model provider: governed by their terms, which we do not control.
What is never collected
GenieLabs has no accounts, so there is no identity to associate a request with. We do not ask for a name, an email address or an organisation.
- No accounts, credentials or payment details.
- No analytics or tracking scripts.
- No copies of your code in application logs.
- No use of your code to train a model.
Controls you can see working
These are properties of the code, not promises. Each one is visible in the interface or in the public relay status endpoint.
- Each editor accepts 20,000 characters. Over that the button stays disabled, and the relay refuses anything past 24,000 rather than truncating, a silently shortened function produces a confidently wrong answer.
- Each address gets 12 requests per minute. Further requests receive 429 with a Retry-After header.
- Cross-site requests are refused, so the relay cannot be used to spend this deployment's inference budget from another page.
- Requests time out after 45 seconds and the stream is closed cleanly.
- The provider credentials exist only in server-side environment variables.
Reading model output safely
The instruments produce suggestions, not guarantees. A bug fix has not been tested against your data. Converted code has not been compiled against your project. A generated SQL statement has not been checked against your schema.
Treat the output as a reviewed draft, and do not paste credentials, private keys, customer data or anything under a non-disclosure agreement into a tool that forwards content to a third party.
Something here unclear or wrong? Tell sdad.pro.