Accounts
Passwords hashed. Sessions are httpOnly cookies. You can revoke sessions from the ops console.
Security
Controls on this host — not a PDF of intentions.
CodeLoom stores accounts, hashed passwords, encrypted project secrets, generated workspaces, visit telemetry, and plan state. Card numbers never touch this app. Here is what that means in practice.
httpOnly
Session cookies
Ciphertext
Project secrets
Whop
Card checkout
/admin
Ops, not public nav
Why this exists
The sandbox is a folder, not a shared gist.
The working loop
Generated apps run under a sandbox path on this machine. Preview binds to localhost and is proxied. The agent does not sudo the VPS. npm/node are allowlisted for installs. Your export is a zip of files; you add production env yourself.
Trust boundary
- Your account
- Project workspace
- localhost Vite
- Whop for cards
In the product
What you actually get.
Secrets
Stored as ciphertext. Not written into the agent transcript. Do not paste live keys into chat.
Workspaces
Per-project files. Preview is a local Vite process, not a public wildcard origin.
Payments
Whop hosts checkout. Plan changes arrive through a signed webhook. Register https://etzelchicko.com/api/webhooks/whop in the Whop dashboard.
Telemetry
Visits and hashed session ids feed /admin so the host operator can see IPs and active sessions. This is ops, not ad tech sold to brokers.
Admin
Email allowlist (ADMIN_EMAILS) or ADMIN_PASSWORD after sign-in. Off the marketing nav.
How
A path you can follow without a call.
01
Use a real password
Or Google/GitHub OAuth when configured.
02
Put keys in Secrets
Never in the prompt, never in a screenshot of the chat.
03
Treat Community as public
Publish is opt-in and visible.
04
Export for your VPC
This studio is not on-prem. Take the zip.
Deep cut
The rest of the page — not a teaser.
What we do not claim
SOC 2 in this copy. Pen-test PDFs. Customer logos we did not earn. If procurement needs a packet, Enterprise is the path — we will say what is true then too.
Generated apps
Auth in a generated app is whatever you asked for. It is not automatically CodeLoom’s account system. Review the code.
Webhooks
HMAC on Whop events. Duplicate events should be idempotent via WebhookEvent.
Preview network
The sandbox can fetch what the host can fetch. Do not assume air gap.
Deletion
Account delete is in /settings. Treat it as irreversible.
Incident
If you find a hole, write the operator. Do not file it as a Community project.
Questions
Ask these before you waste a week.
Is this a mock or a real app?
Real Vite + React + TypeScript files in a project you own. Preview is a running Vite server proxied through the studio iframe.
What happens when I hit the token cap?
The agent stops until the month resets or you upgrade. Pro is $19.99/month via Whop card checkout. The webhook sets your plan to Pro.
Can I take the code?
Yes. Export a zip from the studio. Secrets are not stuffed into the zip as plaintext from the ciphertext store — add env files yourself after export.
Is my app private?
The studio project is yours. Community publish is public. Preview is on this host for signed-in use of that project.
PCI?
We do not store cards. Whop does checkout. Your generated store is only PCI-relevant if you put card fields in it — don’t; use a processor.
Next
Keep going.
Describe it. Watch it become real.
Free is live. Pro is $19.99/month on Whop. The studio, preview, and export are on this host — not a waitlist.