Security in FEWD Studio

A developer tool opens other people’s files: a client’s repository, a template, a download. FEWD Studio treats anything it did not create as something to be careful with, and tells you plainly when it is about to do something that runs code.

This page lists the checks in place. For the notices you may see, and what to do about each, see Security notices explained.

Responsibility rests with you

Please read this first, because it frames everything below.

Ultimately, responsibility for security rests with you. Everything possible has been done to be aware of security threats and to handle and protect against them, and the checks on this page are real. They are still precautions, not guarantees. They reduce risk; they do not remove it.

Being open about how FEWD Studio is made helps you weigh that. It is architected by one independent developer, with its security guided by the published security documentation and practices of other code editors such as VS Code, Zed, Cursor and JetBrains, and built with Claude Code, an AI coding agent, working to that design. It is reviewed, tested and scanned with care, but it has not had the assurance of a large software company, and no software, whoever writes it, can promise to be free of faults.

So please do not place all-out trust in FEWD Studio, or become dependent on it:

• Use it for what it is for. FEWD Studio is for front-end development: HTML, CSS and JavaScript with a live preview. You do not have to use it for project and GitHub management.
• Use other tools alongside it. VS Code, or any editor you prefer, works on the same plain files. Many people do their visual front-end work in FEWD and manage Git, repositories, reviews and deployment elsewhere. That is a sensible way to work.
• Keep your own safeguards. Up-to-date antivirus, your system firewall, a standard user account for everyday work, backups and version control are yours to maintain.
• Only open projects you trust, and read each prompt before you accept it.
• Review what any tool writes before you publish it, including code written with AI help.

These points are also part of the terms and conditions.

Opening a project does not run it

Opening a folder in FEWD Studio reads and edits its files. It does not install packages, start a server or run the project’s scripts.

Three things can run a project’s own code: its Git settings, its package scripts and its dev server. Each is behind a question you answer, described below.

Folder trust

The first time something would run a project’s code, FEWD Studio asks: Trust this folder?

• Trust this folder lets FEWD use the project’s Git settings and run its code to show the preview.
• Not now leaves the project fully editable. Git and the preview stay off. You can trust the folder later from the Git panel.

The question names what will run, for example the exact preview command, the install command, or the shell a terminal will start, so you can see what you are agreeing to.

How trust is scoped:

• It is per folder. Trusting one project does not trust its parent or its subfolders.
• Projects FEWD downloaded for you (From GitHub…) can use Git straight away, because FEWD created the Git settings itself. Running the project’s code still asks, because the packages and scripts in it came from the remote.
• A folder above the project that holds npm settings or packages can affect what runs, so FEWD checks it as well and asks you to trust it or move the project.
• Your home folder and the top of a drive are never trusted. FEWD explains instead of asking, and suggests moving the files into a project folder.
• The answer is stored by FEWD itself, separately from preferences, and no setting or file inside a project can turn the question off.

Installing packages

Installing npm packages can run code on your computer, and newly published packages carry more risk. FEWD Studio lets you reduce that:

• Nothing installs until you press Install. Opening or downloading a project never installs anything by itself, and the dialog shows what is about to run.
• A project with a lockfile installs exactly the versions it lists, however new they are. The lockfile decides every version.
• Packages’ own scripts are skipped by default. Install without running package scripts (safer) is ticked. Some packages need their scripts; if a project does not run, reinstall with it unticked.
• A 7-day wait for new versions, for projects with no lockfile. Versions published in the last seven days are not installed. You can skip the wait for a single install when you genuinely need a brand-new version, and FEWD says so plainly when a version was refused for being too new.
• A one-time consent screen explains the 7-day wait the first time, with a guide for setting up the same precaution for installs you run yourself.

The 7-day wait is a commonly recommended precaution, not a guarantee. It cannot catch every bad package. Supply chain security explains the wider approach.

Terminals

Every terminal asks first. A shell started in a folder can pick up that folder’s own settings, so FEWD opens a terminal in a project only once the folder is trusted. The one exception is FEWD’s own action to set up a brand-new site in a folder it has just created.

Closing the window, reloading it, or quitting stops the terminals, dev servers and installs that FEWD started.

Git and GitHub

• Git does not run in a folder you have not trusted. A project that arrives with its own .git folder brings its own Git configuration, and Git obeys it, so FEWD waits for your answer first.
• FEWD only uses the Git and npm installed on your computer, found in system locations, never one that happens to sit inside a project folder.
• Automatic Git calls are stripped back. Checks on open and pulls run with Git hooks, submodule recursion and risky transports switched off.
• Your GitHub sign-in is handled by FEWD. It uses a device code, the token is stored encrypted by your operating system, and it is passed to Git for a single command, never written into your project’s Git configuration. FEWD does not send it where a repository’s own settings point.
• Push refuses when you are behind, and nothing pushes without you pressing it.

The preview

The preview shows a project’s HTML, CSS and JavaScript, and may load pages you type into its address bar. It is contained:

• It runs in its own sandbox. No Node.js, no access to FEWD’s internals, and no ability to open new windows or start downloads.
• Every permission request is refused. Camera, microphone, location, notifications and device access are all denied, for any page in the preview.
• It keeps nothing. Cookies and local storage from a previewed site are discarded when FEWD quits.
• FEWD’s own preview server stays inside the project. A symbolic link in a project that points outside its folder is not followed, and files starting with a dot are not served.
• The dev server is reachable only from your computer by default. The Preview on your network preference is off unless you turn it on, for example to look at a site on a phone.

Your licence and credentials

• The licence key is stored encrypted, using your operating system’s secure storage (the macOS keychain or Windows data protection).
• The key is masked in the app, showing only its last characters, so it does not appear on a shared screen. Copy places it on the clipboard without revealing it.
• There is no secret inside the application. Activation talks to public endpoints where the licence key is the credential.
• A stored GitHub sign-in is encrypted in the same way and can be signed out from Preferences.

The application window

• A strict content security policy stops the app window loading scripts from anywhere but FEWD itself.
• Navigation is pinned. The window cannot be sent to another site.
• Requests from inside the app are checked. FEWD’s privileged actions only answer the app’s own window.
• Project files are never evaluated by FEWD. No project file is loaded as code inside FEWD’s own processes, and no language server or formatter from a project is started.

Updates

FEWD Studio tells you when a new version exists. Nothing downloads, installs or restarts on its own. Release notes mark a security update, and name the minimum safe version where one applies. Security improvements are made over time, so keep FEWD Studio up to date. See Updates.

Version 1.9.9 strengthened opening and trusting projects, terminals, the preview, Git and GitHub, package installs and licence storage.

Token maps and other project files

FEWD reads a few files that live in a project, such as .fewd/token-map.json. These only name things to show; none of them can run a command, add a value or point at another file. Opening a project that has one is safe whoever wrote it.

What you can do

• Treat FEWD Studio as one tool among several, not the only safeguard.
• Open projects you know, and say Not now to anything you do not recognise.
• Keep your package-lock.json committed, and read its diff.
• Set up the 7-day wait for installs you run yourself.
• Keep FEWD Studio updated.
• Keep API keys and .env files out of your repository.

If you think you have found a security problem in FEWD Studio, please get in touch.