Skip to main content
Origin
SourceQuickstart

Security / Current posture

State the boundary. Do not imply the badge.

This page separates the behavior of the open-source CLI from the roadmap for the managed product. It avoids guarantees that are not represented by a current public control or contract.

Current CLI boundaryRepository → configured provider → local output
  1. 01

    Repository

    Select local evidence

    Code, documentation, configuration, and prior artifacts
  2. 02

    Provider

    Send the generation request

    The configured Anthropic or OpenRouter account handles inference
  3. 03

    Workspace

    Write local output

    Drafts and trace records return to the .devrel/ directory
  4. 04

    Human gate

    Review before commit

    Repository permissions and Git workflow control publication
Publication stateReview requiredNo automatic publish step

Verifiable behavior

Controls available in the CLI today

Repository-local outputs

The CLI writes configuration, deliverables, and trace records under .devrel/ in the repository where it runs.

Explicit provider setup

Initialization asks you to configure Anthropic or OpenRouter. Generation requests are governed by the provider and account you choose.

Restricted key file

The setup flow writes the provider key to .devrel/.env with restricted local file permissions.

Human publication gate

Origin produces reviewable files. Your Git workflow determines what is committed, merged, or published.

01

Open-source data boundary

The CLI operates in the repository where you invoke it and writes its working files under .devrel/. Review those files before committing them, and use repository permissions to control who can read the resulting artifacts.

02

Third-party model providers

Origin sends generation requests to the provider configured during setup. Review that provider's retention, training, regional processing, and account terms for the specific plan you use. The website does not claim a universal zero-retention agreement.

03

Managed Cloud status

Origin Cloud is presented as a private-beta path. SOC 2 Type II remains on the roadmap and is not described as a current certification. Deployment, deletion, export, and subprocessor commitments should be confirmed in the applicable agreement before managed use.

04

Report a security issue

Send a concise reproduction, affected version, and impact to daria@gtm-labs.co. Avoid including secrets or customer repository content in the initial report.