# Security Review

## Current State

Coworker starts from a local-first security model:

- Web/PWA access is opt-in.
- Pairing tokens are hashed before storage.
- Workspace file access is path-confined.
- Model endpoints are user-configured local or OpenAI-compatible URLs.

## Required Checks Before Release

- Verify web access is disabled by default.
- Verify unauthenticated web API requests return `401`.
- Verify paired device tokens are not stored in plaintext.
- Verify workspace reads reject path traversal.
- Verify build artifacts exclude local app data and repository maintenance files.
- Run scheduled security scan in Gitea Actions.