Security on Crafta is not something each creation has to remember. It is the room everything runs in.
AI-written code does not think about safety.
The models that write app code write what works, not what is safe. Across the industry, generated apps have shipped with exposed databases and missing protections. That is not a reason to avoid AI-built apps. It is a reason to change where the safety lives: in the platform, not in each app.
The safety is in the platform.
A sealed sandbox
Everything you make runs in a locked-down sandbox with a strict content security policy. It cannot reach your accounts, your files, or anything else you have made.
No backend to leak
Crafta creations are single files with no server code of their own. There is no per-creation backend to misconfigure, no keys inside it, nothing for you to patch.
One guarded door for data
When a creation stores or reads data, the request goes through Crafta’s gateway with its own guardrails. Creations never hold credentials, and each one’s data is scoped to it alone.
A closed ecosystem
Creations run inside Crafta on web and iOS. The content security policy decides what each one can load and where it can send data. Everything else is blocked by default.
What we do not claim
No human reviews every app before it goes live, and we will not pretend otherwise. The protection here is structural: the sandbox and the gateway hold whether an app is well-written or not. If something in the gallery looks wrong, the Content Policy page explains what is allowed and how reports are handled.
The safety is not in the app. It is in the platform.