Multilo's assistant can read files, run commands and install extensions on your computer. Over the past two months we've tightened the parts of the app that decide what it's allowed to do. Most of it is invisible, which is how it should be.
Updates and extensions you can trust
- Every app update must be signed by Multilo and match the release record the app has verified for itself. An update that has been tampered with, isn't signed, or would install an older version is refused.
- Official extensions and skills must carry Multilo's own signature. Nothing can present itself as "official" without it.
Trusted folders
Projects you open from elsewhere start in Restricted Mode: the terminal, version tracking, git hooks and the project's own MCP servers stay off until you choose Trust This Folder. Projects Multilo creates for you are trusted automatically, and stay trusted after a rename.
Approvals that mean what they say
- Always allow now remembers the command it was given for, and shows it on the button.
- Commands that delete files always ask. There's no "always allow" for them.
- Changes to the assistant's own setup (its agents, skills, instructions and hooks,
AGENTS.md, and your.gitfolder) always ask, unless you've switched on Bypass permissions. - Code the assistant wants to run is shown on the approval card before you approve it.
- Permission mode (Approve, Autopilot or Bypass permissions) now lives in Settings → AI Agent, and Bypass asks you to confirm before it switches on.
Signing in
- The sign-in paste box now takes a short-lived one-time code instead of a long-lived connection key.
- The app no longer accepts sign-in from old-style links, closing a way someone could sign you into their account without you noticing.
- A slow sign-in no longer quietly falls back to a less secure method.
Smaller hardening
- Your GitHub token is only ever sent to github.com.
- Extensions run under a stricter security policy.
- Network-share paths on Windows are refused.
- A project's memory folder is git-ignored automatically, so remembered notes aren't committed by accident.