Security model

Studio never handles private keys

Studio does not request, store, transmit or log a private key, and never signs server-side. It constructs an unsigned transaction; your wallet signs and broadcasts it; Studio watches the resulting hash. There is no signing code in the application and there is no custodial path.

Wallets are discovered over EIP-6963, so every injected provider is offered and you choose. MetaMask is a first-class target but never assumed to be the only one.

Where your source goes

Nowhere. Solidity compiles locally in a Web Worker. Your workspace is stored in this browser. The only outbound requests Studio makes are JSON-RPC calls to the Kortana endpoint you selected, and fetching the pinned compiler binary from the official Solidity CDN. No telemetry collects source code.

Imported files are untrusted

Every import path runs the same validation: archives are size-limited, paths are normalised, and path traversal, absolute paths and drive-qualified paths are rejected rather than sanitised away. A `..` in an archive is a signal about the archive, not a typo to be quietly corrected. Imported code is never executed.

What Studio will not fabricate

No synthetic compilation, no fake receipts, no invented contract addresses, no hardcoded gas figures, no randomly generated transaction hash presented as real, and no diagnostic the underlying tooling cannot substantiate.

A contract address appears only after a receipt provides one. A deployment record is written only when the node confirms it. "Build successful" appears only after a real, executed build. When something is unavailable, Studio names the missing capability instead.

Deployed code is final

Kortana supports no upgrades, no proxies and no cross-engine delegatecall. That is a constraint and also a guarantee: nobody can change the contract your users audited. Review warnings before deploying, because there is no second chance to patch.