Security

Morphy is made by Casper Apers in Antwerp, Belgium. Its Windows installer is signed with the name of his business, Apers, and its Mac app with his Apple developer account, Casper Apers (49CA43438J).

Every installer is published on GitHub, at github.com/casperaap/morphy-releases-, with its release notes, and linked from get.appmorphy.com. Download Morphy from one of those two places only.

Windows

Morphy-Setup.exe is signed by Apers through Microsoft's Artifact Signing. Right-click it, choose Properties and open Digital Signatures: the signer is Apers. Or, in PowerShell, in the folder with the download:

Get-AuthenticodeSignature .\Morphy-Setup.exe | Select-Object Status, @{n='Signer'; e={$_.SignerCertificate.Subject}} | Format-List

It should say Status : Valid and Signer : CN=Apers. While Morphy is new, Windows can still show a blue Windows protected your PC screen. Click More info: it must say Publisher: Apers. If it says Unknown publisher, don't run the file: it isn't Morphy. Download it again from get.appmorphy.com.

Mac

The Mac app is signed with an Apple Developer ID and notarized by Apple, so macOS checks it before it first opens. To check it yourself, in Terminal:

spctl --assess --type execute -vv /Applications/Morphy.app

It should say accepted, source=Notarized Developer ID and origin=Developer ID Application: Casper Apers (49CA43438J).

Linux

The AppImage and the .deb aren't signed, which is usual on Linux. Check them with the release's checksum file, below.

Checksums

Every release has a SHA256SUMS.txt file listing the SHA-256 fingerprint of each download. GitHub shows the same fingerprint next to each file. Work out your download's fingerprint and compare:

• Windows (PowerShell): Get-FileHash .\Morphy-Setup.exe
• Mac: shasum -a 256 Morphy-mac-arm64.dmg
• Linux, with SHA256SUMS.txt in the same folder: sha256sum -c SHA256SUMS.txt --ignore-missing

Antivirus scans

Each Windows installer is also scanned on VirusTotal, which runs it past more than 60 antivirus engines. Morphy 0.1.21: 0 of 65 flagged it (October 14, 2026). See the report.

Morphy looks for new versions on its GitHub releases page and installs them on the next restart. You can turn that off in Settings → General → Install updates automatically; Morphy then only tells you when a new version is out.

Every update is checked before it installs. Its file must match the SHA-512 fingerprint published with the release. On Windows the new installer must also be validly signed by Apers, or Morphy won't install it; on a Mac, macOS checks Apple's signature. The .deb for Linux doesn't update itself: download the new one.

On Windows and on a Mac, Morphy checks its main package every time it starts, and refuses to run if the package was changed after it was built. (The Linux version doesn't have that check yet.) On every system, it can't be started with Node.js debugging or extra code switched in (--inspect, NODE_OPTIONS).

The AIs you connect (Claude Code, Codex, Grok, Copilot and the others) run as programs on your computer, under your own user account, in the folder you give each chat. What an agent may do without asking depends on that chat's permission mode:

• No guardrails: edits files and runs commands without asking.
• Auto-accept edits (called workspace write outside Claude chats): file edits in its folder go through, and anything else asks first. Codex runs commands inside its own sandbox instead, limited to the chat's folder.
• Ask first: asks before it changes a file or runs a command.
• Plan only: reads and plans, and changes nothing.

New chats start in No guardrails, and you can change that in Settings → General → New chats start in. From Morphy 0.1.22, a new install starts in Auto-accept edits instead; an install from before keeps the setting it has.

Some commands are hard to undo. Add them to Settings → General → Always ask before, like git push or rm -rf, and every agent asks you before it runs one, even in No guardrails. It doesn't cover Codex in Ask first or Auto-accept edits (its sandbox doesn't hand commands to Morphy to check), Antigravity (it can't ask from inside Morphy), or a chat opened as a terminal.

In No guardrails, an agent can do anything your user account can do. For a folder you can't easily restore, use Ask first, or keep it in Git. In a project folder, Morphy also keeps a copy of the files before and after each turn (when Git is installed), so you can undo what a turn changed.

HTML cards on the canvas are small web pages, so Morphy runs each one in a sandbox, with an origin of its own. A card can't open windows or leave its frame, reach your files outside Morphy's cards folder, use Morphy's functions or see your keys, and the data it saves is its own.

A card can open web links (http, https and email links only). If a card wants to start an agent, Morphy asks you first. Cards added from the card library work offline, with no internet access, until you or Morphy change them.

Morphy's windows run with Electron's sandbox and context isolation turned on and no Node.js in the page, and the app checks that every request it gets comes from its own window.

The browser in the dock is kept apart from the app: it has its own cookies and storage, no way to reach Morphy, and every permission a site asks for (camera, microphone, location, notifications) is refused. A link in a chat to a program or a script (an .exe, a .bat, an AppImage) asks you before it runs anything.

API keys you add in Morphy are kept in a file in Morphy's folder on your computer (assistant/.env) and are sent only to the service they belong to. Claude Code, Codex and the other tools keep their own sign-ins where they always do. If you keep more than one Claude or Codex account in Morphy, the extra sign-ins are sealed with your system's own encryption, where it has one.

Your Google sign-in (account ID, name, email and picture), a note once a day that the app was opened, and a check of your plan. Anything more only when you choose it: error reports if you turn them on (with names, folders and anything that looks like a key taken out first), your numbers if you join the leaderboard, and feedback you send.

Morphy never sends us your chats, prompts, files, code or canvas: your messages go straight from your computer to the AI provider you chose. The privacy policy has every detail.

Remote, which lets your phone see and steer your chats, is off until you turn it on. Your phone then talks to your computer over your own Wi-Fi network, never through our servers. You pair a phone by scanning a QR code; each phone gets its own key, which Morphy keeps only in scrambled (hashed) form, and a phone that isn't used for 30 days is forgotten. The connection inside your network isn't encrypted (it's plain http), so use Remote on a network you trust, like your home Wi-Fi. Turning Remote off stops it.

Email security@appmorphy.com, or report it privately on GitHub (Report a vulnerability, in Morphy's releases repository). Say what you found, how to make it happen again and your Morphy version (at the top of Settings → General). We aim to reply within 3 working days and to fix serious problems as soon as we can.

Please give us the chance to fix it before you tell anyone else, 90 days at most. If you like, we'll thank you by name in the release notes of the version that fixes it.

Testing on your own computer and your own account is welcome. Please don't access other people's accounts or data, disrupt our servers, or try to trick people.

• Morphy hasn't had an independent security audit yet.
• Its source code isn't public.
• The Linux packages aren't signed, and the Linux app doesn't check its package when it starts.
• Morphy Remote's connection inside your network isn't encrypted.
• In No guardrails, an agent can run any command your user account can, and Always ask before has the gaps described above.