Sign up

Use cases / Engineering

Codebase review.
Secrets left out.

Attach a folder or a .zip and ask for a review. Your browser packs the code, leaving out dependencies, build output and secrets such as .env files and private keys. Fixes come back as diffs, applied in your browser to a patched .zip you can download.

An illustration of the workspace. The repository and its findings are made up.

The workflow

Recorded in the workspace

See it in the workspace.

Verified, and encryptedEach answer shows its path, sealed in your tab, and what actually left the device.

Recorded in the workspace; answers scripted for the recording, some clips sped up. The Verified checks ran in the browser against a recorded attestation.

Where your data goes

Encrypted before it leaves your device.

In your browser

  • Packs the folder, leaving out dependencies and secrets
  • Applies the diffs and builds the patched .zip
  • Runs JavaScript from answers only when you press Run, with no network

Undergrove’s relay

  • Checks your sign-in and allowance
  • Passes the encrypted code on, unable to read it
  • Sees its size and time

Inside the enclave

  • Runs the model on your code and question
  • Indexes a large codebase you add to Documents, so only matching passages are sent
  • Tinfoil states nothing in it persists between restarts

Before sending, your browser checks the enclave’s hardware attestation against Tinfoil’s open-source release. Answers come back the same way, encrypted until they reach your browser. What verification proves

Built from

Features in the workspace today.

Folders and .zip files

Attach a folder on desktop, or a .zip anywhere. Dependencies, build output, lock files, binaries, .env files and keys are left out.

Diffs and a patched .zip

Unified diffs in answers are shown file by file, applied to your codebase in the browser, and downloaded as a .zip.

JavaScript runs

Press Run under a JavaScript block to run it in a new worker with network and storage removed.

Auto

Auto picks a model strong at code when your message is about code, in your browser.

Developer API

The same models through an OpenAI-compatible API, for scripts and CI, with an encrypted mode.

What it isn’t

The limits, plainly.

  • Review every diff before you use it. A model can propose changes that run but are wrong.
  • Secrets are left out by file name: .env files, private keys, .npmrc and the like. A key written inside an ordinary source file is sent with the rest of the code.
  • The developer API works differently: our gateway reads API requests in memory to check them, unless you use encrypted mode.
  • Undergrove holds no certifications such as SOC 2 or ISO 27001, and hasn’t been independently assessed yet.
The full privacy notice

Try it with your own code.

Open the workspace, add your code and paste the request. Without live access, answers are prewritten samples.

Open the workspace
The request
Review the webhook retry logic in this codebase for race conditions and missed retries, and propose fixes as unified diffs.