Coworker/SECURITY.md

Security

Coworker is a local-first coding app with powerful project and agent capabilities. Treat it like a developer tool with access to your files and local model endpoints.

Reporting

Open a private issue or contact the repository owner if a vulnerability exposes files, tokens, local services, paired devices, or agent permissions.

Defaults

• Web access is disabled by default.
• LAN/Tailscale access requires an explicit settings change.
• Mobile access requires a pairing code.
• Device tokens are stored as hashes.
• Workspace file access is confined to selected project roots.
• Agent file writes and command execution require visible approval.

Secrets

Never commit:

• .env files,
• API keys,
• provider tokens,
• pairing tokens,
• certificates,
• private keys,
• app data,
• generated installers outside release artifacts.