# Security first

Speedwave connects an AI assistant to the services you work in, such as Slack and GitLab. That means giving the assistant real tools that touch real systems, and a model can be tricked by a malicious message or a poisoned web page. So Speedwave assumes the assistant might one day misbehave, and every design decision limits how far that problem could spread.

These principles come from Speedwave v1 and are treated as fixed. A change that would relax one of them is rejected; a feature that would need one relaxed gets redesigned instead.

## The promises, in plain words

**Claude holds no credentials.** The container where Claude runs has no service tokens and no access to the container engine that creates and controls containers. If Claude is tricked or compromised, there is nothing to steal, because the keys were never placed there. Claude also cannot start new containers or break out into other ones. Read the detail in [Isolation](/docs/security/isolation/).

**Each integration sees only its own credential.** Every service you connect runs in its own worker, and Speedwave mounts only that worker's own credential into it, read-only. A problem in the Slack worker cannot expose the GitLab credential.

**A fail-closed gate runs before any container starts.** A startup check validates the generated setup and refuses to start if a token-like secret or a container engine socket would ever be exposed to Claude's container. See [SecurityCheck](/docs/security/securitycheck/).

**Sensitive values are tokenized.** Data an integration returns is masked before the model ever sees it, and restored only when a tool needs the real value. See [Tokenization](/docs/security/tokenization/).

## Defense in depth

No single layer is asked to hold on its own. Escape the executor sandbox and you land in a container with no service tokens, all Linux capabilities dropped, and a read-only filesystem. Escape that container and, on macOS and Windows, you are still inside a virtual machine, not on your machine.

The router that sees every tool call, the hub that forwards each request to the right worker, stores zero credentials itself. Compromising it leaks no secrets. Downloads are checked before they are trusted, too: the Claude Code program is verified against a known, version-pinned SHA256 checksum before Speedwave uses it.

## Read next

[Isolation](/docs/security/isolation/)
  [SecurityCheck](/docs/security/securitycheck/)
  [Tokenization](/docs/security/tokenization/)