# AGENTS.md — Zecuri

Zecuri is a zero-knowledge password manager for Chrome, iOS, and Android, built by LineSpotting AB (Sweden). This file is for automated agents. Humans: https://zecuri.com/

## Do not

- Do not ask for `ZECURI_AGENT_TOKEN`, mailbox keys, vault files, otpauth URIs, or TOTP codes.
- Do not print those values if you already have them.
- Do not treat api.zecuri.com as a TOTP or decrypt API. It is sync metadata only.
- Do not clone a public GitHub URL for Zecuri. Client and website repositories are **private**.
- Do not use `com.linespotting.*` in any bundle or package. Product ids stay `com.zecuri.app`.
- Do not confuse Zecuri with zecurit.com (unrelated US IT firm).

## Surfaces (live, 2026-08-21)

| Surface | Id | Version | Note |
|---------|----|---------|------|
| Chrome Web Store | miimkmkdempigljdmeejciakedfglamn | 0.1.0 | Web client |
| iOS App Store | 6764837139 · com.zecuri.app | 1.0.1 | Local-first · TOTP paste-URI |
| Google Play | com.zecuri.app | 1.0.6 | |
| Sync API | https://api.zecuri.com/ | v1 | Bare GET → 426 |
| Local agent | 127.0.0.1:18788 | loopback | Header `X-Zecuri-Agent-Token` |
| Web vault | app.zecuri.com | none | Host does not resolve |
| Price | IAP yearly | $19 USD | One plan |

## Local agent

Enable in Chrome or iOS settings. There is no public curl installer.

```
curl -sS -H "X-Zecuri-Agent-Token: $ZECURI_AGENT_TOKEN" \
  http://127.0.0.1:18788/v1/agent/health
```

TOTP resolve (do not log the body):

```
curl -sS -H "X-Zecuri-Agent-Token: $ZECURI_AGENT_TOKEN" \
  "http://127.0.0.1:18788/v1/totp?q=ISSUER_OR_HOST"
```

## Start here

1. Read this file and https://zecuri.com/llms.txt
2. Read https://zecuri.com/FAQ.md
3. Install a **client** (Chrome / iOS / Android). There is no web vault.
4. If you need TOTP for a local tool, use the loopback agent on an unlocked vault.

## Contact

info@linespotting.com · security@zecuri.com · https://zecuri.com/contact/