Private Code Audits: Local Engine vs. Your Claude Key

There's a quiet cost to most AI tools that nobody prints on the pricing page: to get feedback, you hand over your source. Your proprietary code lands on someone else's server — logged, retained, maybe used to train a model, one breach away from public. For a lot of teams, that's a dealbreaker before the tool even runs.

It doesn't have to be the trade. Whether an AI audit is safe comes down to one question — where does your code actually go? — and the honest answer is architectural, not a promise in a privacy policy. Here's how to get a real code and UX review while keeping your source on your own machine.

The only question that matters: where does the code go?

"Is it safe to paste my code into an AI tool?" is really "what happens to the bytes after I paste them?" Most tools follow the same path: your code travels to their backend, gets processed there, and is retained under their terms. Even with good intentions, that server is now a place your source lives — a place that can be subpoenaed, breached, or quietly repurposed. The way to avoid all of that isn't a stronger pinky-promise. It's not sending the code to a middleman in the first place.

Privacy you can verify beats privacy you're asked to trust. Architecture is the promise.

Two engines, two privacy models

UXexpert.ai is built around this exact concern, with two ways to run — and it helps to understand precisely what each does with your code.

The local engine — nothing leaves your device

The default engine runs entirely inside your browser. It parses and analyzes your HTML, CSS, and JavaScript on your own machine, using your own compute. The code you paste, drop, or fetch is never transmitted anywhere — not to UXexpert, not to anyone. There is no upload, because there is no server to upload to. For sensitive or proprietary code, this is the safest possible model: the audit happens where the code already is.

The Claude engine — direct to Anthropic, on your key

When you want the deeper reasoning of a large model, the optional Claude engine uses your own Anthropic API key. The request goes directly from your browser to Anthropic's API — UXexpert has no backend in that path and never receives your code or your key. What Anthropic does with API data is governed by your own agreement with them, not by us. You're choosing to share with one party you already have a relationship with, on your terms, rather than routing through an intermediary.

Why "no server of our own" matters

The strongest privacy guarantee is a missing component. UXexpert is served as a static page — there is no UXexpert application server sitting between you and your audit. That absence is the point: there is no middleman to log your code, retain it, get breached, or train on it, because there's no middleman at all. You can't leak what you never receive.

Keeping code private without giving up AI

You don't have to choose between "private" and "powerful." A practical approach:

• Start local. Run the in-browser engine first. It catches the objective, universal issues — accessibility, structure, obvious debt — with zero data leaving your device.
• Escalate deliberately. For the deeper pass, use the Claude engine with your own key, knowing the data path is browser-to-Anthropic and nothing more.
• Cap the key. Use an API key with a spending limit, scoped to this use. It's your key; keep control of it.
• Redact if needed. For the most sensitive work, audit representative components rather than secrets-laden files. The patterns you're reviewing rarely require the credentials.
• Read the data path, not just the badge. "Secure" is marketing. "Runs in your browser" and "goes directly to a provider you control" are architecture. Prefer the architecture.

Frequently asked