# Security

Coworker is a local-first coding app with powerful project and agent capabilities. Treat it like a developer tool with access to your files and local model endpoints.

## Reporting

Open a private issue or contact the repository owner if a vulnerability exposes files, tokens, local services, paired devices, or agent permissions.

## Defaults

- Web access is disabled by default.
- LAN/Tailscale access requires an explicit settings change.
- Mobile access requires a pairing code.
- Device tokens are stored as hashes.
- Workspace file access is confined to selected project roots.
- Agent file writes and command execution require visible approval.

## Secrets

Never commit:

- `.env` files,
- API keys,
- provider tokens,
- pairing tokens,
- certificates,
- private keys,
- app data,
- generated installers outside release artifacts.