Privacy, encryption & AI coach

Everything covered elsewhere in this guide works fully offline, with no account. This page covers the two things that touch a password or an account: encrypting secrets at rest, and the optional AI coach.

Encrypting secrets at rest

By default, project data — including captured Authorization/Cookie header values and auth-profile secrets — is stored as plaintext inside the project's local SQLite file. If that file could end up somewhere you don't fully trust (a shared machine, a synced folder, a backup), turn on encryption from Settings:

1. Set a project passphrase. It's run through Argon2id to derive an encryption key — the passphrase itself is never stored.
2. From then on, secrets are encrypted with AES-256-GCM before they're written to disk.
3. Reopening the project later prompts you to unlock it with the same passphrase before those fields are readable again.

There's no recovery path if you lose the passphrase — that's the point of it being derived rather than stored. Everything else in the project (endpoints, findings metadata, non-secret exchange data) stays readable without unlocking.

AI coach

Studio's free core never needs an account. The AI coach is the one paid, opt-in feature: a chat interface scoped to your current project and whatever findings you select, backed by the existing Agent Breach cloud account system.

• Sign in from the AI coach view — this uses product=studio so it never lands you on the unrelated Agent Breach SaaS dashboard. Passkey or authenticator OTP, no password.
• Credits reset monthly rather than accumulating, on either the monthly or discounted yearly billing plan.
• What gets sent: only the project context and findings you explicitly bring into a chat — not your whole proxy history. Cookies and tokens are stripped from AI prompts by default before anything leaves your machine.

If you never sign in, the AI coach view simply sits unused — nothing else in the app depends on it or is gated behind it.