AI and this project

Last updated: August 18, 2026

Sona’s code is written with AI coding agents. This page explains what that means for anyone forking it.

The code

Most of Sona’s code is written by Claude Code, Anthropic’s AI coding agent, working from designs and decisions made by the project’s maintainer. Every change goes through the test suite and a set of review passes. One of those passes is a second AI model reviewing the first one’s work, and one is CodeRabbit, a third-party review service. The project has one maintainer and no review team; that person approves every merge and clicks every deploy. This marketing site is built the same way.

The text

Most of the words on this site, including this page, were drafted with AI. The maintainer edits and approves them before they go up.

The art

No artwork, images, audio, or video in the project is AI-generated. Sona ships almost no media of its own, and what little it does ship is not AI-made. Everything else a Sona site displays is chosen by the person who runs it.

Your site’s own page

Sona ships an AI disclosure page at /ai. It credits this project for building the software, so running a Sona site doesn’t imply you wrote it. In your voice it says only that the art on your site is commissioned from human artists rather than AI-generated, and the setup wizard asks you to confirm that before turning the page on. If you don’t confirm, the page stays off. A fork that skips the wizard entirely starts with the page on and the default text. However you start, Settings lets you rewrite the page, switch it off, or turn it back on.

Visitors’ data

A live Sona site never calls an AI service, and neither does this one, so nothing you do while browsing is sent to one. When the site is being worked on, the maintainer’s tools can read its logs and data the way any developer would, and those logs can include your IP address and the pages you requested. Neither of those tools trains on what it is sent: model training is switched off on the Anthropic accounts used here, and CodeRabbit states that the data from its reviews is never used for training. The privacy policy has the details.

The model

Claude is trained on text and code scraped from the internet. That data isn’t the project’s, and the project can’t vouch for how it was gathered. If that’s a dealbreaker for you, that’s fair.

The full policy

AI_POLICY.md in the repository has the complete version, including the rules every agent session works under and what contributors have to disclose.

Reporting security problems

If you find a vulnerability, report it privately, either through GitHub’s report form or by email to security@sona.fast. Every Sona site runs the same code, so posting details publicly exposes all of them before a fix exists. Each site serves a /.well-known/security.txt that points to these same channels.

This page is updated when any of this changes.