Security and data

Trawler points agents at your product, so it is fair to ask what they can touch. The short answer: a browser limited to your product’s own origin — and the one setup was redirected to, if any — and nothing else.

What an agent can do

An agent has a browser and a handful of tools of its own, and that is all. It has no shell, no file system and no way to run code.

Browser actions: open an address, go back, read the page, click, type, choose from a list, press a key, hover, wait, answer a dialog, and dismiss a file picker. It cannot upload files from anywhere, cannot take screenshots, and cannot run JavaScript in the page. It reads pages as text.
Its own tools: write a note to itself, report a finding, mark a goal reached or failed, sign in with its test account, and finish.

Where it can go

The browser opens only the allowed origins. Everything else is stopped before it is sent:

requests to other origins, including scripts, styles, images, API calls and sign-in pages;
redirects to another origin, followed one hop at a time and checked at each;
WebSockets to another origin;
service workers, and pages the browser would otherwise load in advance;
javascript:, data: and any other non-web address.

When a page the agent opens, or is redirected to, is blocked, it is told so and carries on. For other blocked requests, the first one to each origin in each session and replay is recorded in the run’s events, without interrupting the agent.

Credentials

Test account passwords are typed by Trawler, not the model — only into a real password field, and only on an allowed origin. The model cannot type into a password field, press keys other than Enter, Tab, Shift+Tab and Escape while one has focus, or read one. See Test accounts.
Masking. Every password and secret a run knows about is replaced with ••• in everything the model reads and everything the run records — in its plain form and in the escaped and encoded forms a page could show it in.
At rest. Test account passwords and the model key are encrypted before they are stored, each bound to where it belongs, so a copy moved elsewhere cannot be decrypted. Neither is ever sent back to your browser; the app shows at most the last four characters.
In use. Passwords are decrypted inside Trawler and handed to the runner carrying out each of a run’s sessions, replays and judge calls. The model key stays with Trawler: runners call models through Trawler, which adds the key to each call, so a runner never holds it.

What Trawler reads when setting up

Setup fetches the one address you give it, as described in From a URL to a plan. It refuses private, loopback, link-local and other reserved addresses — checked against the address it actually connects to, on every redirect — so it cannot be pointed at Trawler’s own network. The same guard applies to the base URL of an OpenAI-compatible provider.

What is stored

For each workspace: its projects, with their people, goals and test accounts; its runs, with a copy of the plan each started from, every event the run recorded, the findings, the verdicts and the cost of every model call; and its model key. The database keeps each workspace’s rows from every other workspace, not only the app.

What goes to the model provider

Each call to the model carries what that step of the conversation needs: the person’s brief and goals, the text of the pages they have read, their notes, and — for replays and the judge — the steps and the reports being compared. Passwords and secrets are masked before anything is sent. Through OpenRouter, every call asks providers not to keep or train on the data; a key from OpenAI, Anthropic, Google or an OpenAI-compatible service sends calls straight to that provider, under its own data policy.

Not built yet

Proof that the product is yours. Trawler does not yet verify that you control the product you point it at. Until it does, hosted runs are limited to the private beta.
Deleting things. There is no way yet to delete a project, a run or the model key from the app.
Screenshots. Findings carry text only.