Security
How PulseDev handles your code.What runs where, and who sees it.
PulseDev runs on your Mac. The widget on your dev site talks to a server inside the desktop app, and your own coding agent makes the changes. Here is exactly how that works.
Where does PulseDev run?
Everything runs in the desktop app on your machine. When you start a project, the app starts a small HTTP server for that project inside its own process, on its own port. Stopping the project stops the server. There is no PulseDev cloud service between the widget and the server.
By default the server listens on 127.0.0.1 and ::1 only, so other devices can’t reach it. If you turn on Allow network access in Settings › General › Network, the server also listens on your local network, for example so you can test on your phone. The project token is still required.
Who can talk to the local server?
Each project gets its own token when you add it: 24 random bytes, encoded as URL-safe base64. Every request to the server needs that token, sent as an Authorization: Bearer header or a ?token= query parameter. Without it the server answers 401.
Four routes are open without a token, because the widget needs them before it has connected:
/widget.js, the widget script itself/auth/validate, which checks a token you paste in/status, which returns “ok” and the server’s uptime/providers, which lists the agent CLIs the app found
Browsers add one more check. By default the server only accepts cross-origin requests from pages served on localhost, 127.0.0.1 or ::1, on any port. Turn on Allow any origin in Settings › General › Network if your dev site runs on another hostname, such as a .test domain. The token is still required either way.
Who actually edits my code?
Your coding agent. PulseDev starts the Claude Code, Codex or Gemini CLI you installed, on your machine, in your project folder, signed in with your own account. PulseDev has no AI service and never receives your code or prompts.
The agent works as it does in your terminal. It reads files in your project and sends prompts and file contents to its own vendor. That part is covered by the vendor’s terms, not ours. The privacy policy links to each one.
Can anything change without my approval?
The widget starts in review mode. PulseDev asks the agent to read files and return its change as a proposed diff rather than edit files. You read the proposal in the widget. Approve applies it to your files and Reject discards it. Review mode is an instruction to the agent, not an enforced read-only sandbox; the agent’s own permissions still apply.
Agents that use the Agent Client Protocol (Codex with the codex-acp adapter and Gemini CLI) can ask for permission mid-run. Those requests show up in the widget and the run waits for your answer.
Auto-apply is an opt-in switch in the widget. With it on, the agent edits files directly: PulseDev starts Claude Code with --dangerously-skip-permissions and Codex with --full-auto, and answers ACP permission requests with allow. Revert is available for supported changes that PulseDev records. Some direct agent edits, including Codex CLI Auto-apply edits, are not recorded for Revert; use git to review and undo those changes. Use Auto-apply only on projects you’re comfortable letting the agent change, and keep your work in version control.
Review the applied changes in your editor and use your usual git workflow to choose what to commit.
What does setup change in my project?
Set up project adds the Vite plugin to your Vite config, or the widget script tag (with your project token) to your HTML. It saves a .pulsedev.bak copy next to every file it changes. For Next.js and Nuxt it shows you the line to add instead.
Connect editor (MCP) writes a pulsedev entry into .mcp.json, .cursor/mcp.json and .vscode/mcp.json, with the local URL and your project token. The token only works against the server on your machine, but if your repository is shared you may want to keep those files out of it.
The Vite plugin only runs in development. If you use the plain script tag, leave it out of production builds.
What does the app send to PulseDev?
- License checks, on Pro and Founder Lifetime only: your license key, an instance ID and a device label such as “PulseDev on macOS”, sent to pulsedev.app, which confirms them with LemonSqueezy. The Free plan makes no license calls.
- Prices, loaded from pulsedev.app when you open the License screen.
- Updates, checked and downloaded from cdn.pulsedev.app.
- Anonymous usage events, such as app opened or fix approved, with a random install ID. They never include code, prompts, file paths, project names, URLs, email or license key. Switch them off in Settings › General.
That is the full list. The app has no crash reporting, and fonts and assets are bundled. Details are in the privacy policy.
How do I report a security issue?
Email [email protected] with the details and your app version. Please don’t post it publicly until we’ve had a chance to fix it.
Local server. Your agent.Your approval.
Free to start. No account needed.