30 lines
852 B
Markdown
30 lines
852 B
Markdown
# Security
|
|
|
|
Coworker is a local-first coding app with powerful project and agent capabilities. Treat it like a developer tool with access to your files and local model endpoints.
|
|
|
|
## Reporting
|
|
|
|
Open a private issue or contact the repository owner if a vulnerability exposes files, tokens, local services, paired devices, or agent permissions.
|
|
|
|
## Defaults
|
|
|
|
- Web access is disabled by default.
|
|
- LAN/Tailscale access requires an explicit settings change.
|
|
- Mobile access requires a pairing code.
|
|
- Device tokens are stored as hashes.
|
|
- Workspace file access is confined to selected project roots.
|
|
- Agent file writes and command execution require visible approval.
|
|
|
|
## Secrets
|
|
|
|
Never commit:
|
|
|
|
- `.env` files,
|
|
- API keys,
|
|
- provider tokens,
|
|
- pairing tokens,
|
|
- certificates,
|
|
- private keys,
|
|
- app data,
|
|
- generated installers outside release artifacts.
|