Privacy & security
What stays on your machine, and what Luora will never do.
Your code and runs
- The exporter and the bridge run on your machine; your code is never uploaded.
- A dropped luora-data.json is read in your browser tab only.
- Triage notes, scenarios and AI settings are kept in your browser, per contract.
- Luora's server only serves the app and the exporter scripts. Its local-only routes answer 404 on luorasec.xyz.
Defensive by design
- No exploit code, attack contracts, calldata or attack steps, in the app or from its AI prompts.
- Scenarios and generated tests check intended behaviour.
- Exploits are closed, historical incidents written as post-mortems, without addresses or payloads.