Security

Report a vulnerability

Please report security issues privately. Do not open a public issue, post proof-of-concept details, or include credentials, private keys or personal data.

Private report: Open a GitHub security advisory for beniaminp/desktop-agent.

If advisory access is unavailable, contact the maintainer through github.com/beniaminp and ask for a private channel. Do not send the details in a public message.

In scope

The Electron app: main process, preload bridge, IPC validation, renderer, folder broker, snapshots and update flow.
The Chrome bridge: extension service worker, native messaging host, Unix socket, origin/token checks and the app’s Chrome target.
The Open Desktop Agent Chrome Bridge extension published in the Chrome Web Store.
The phone relay Worker and Durable Object in apps/relay.
The policy site in apps/policies, including its Cloudflare configuration.

Out of scope

Issues that require a jailbroken or already-compromised machine, or an attacker who can read the user’s OS secret store.
Self-XSS, clickjacking on pages without a meaningful action, or missing security headers with no demonstrated impact.
Denial of service caused only by asking the local agent to process an enormous file or page, unless it bypasses a documented limit.
Findings in third-party model providers, Chrome itself, Cloudflare’s platform or GitHub’s platform.
Reports from automated scanners without a reproducible impact.

What to include

A short description of the issue and the affected component/version.
Reproduction steps or a minimal proof of concept that does not target other people’s data.
The security impact: what an attacker gains and what preconditions are required.
Suggested remediation if you have one.

Our process

We aim to acknowledge a report within three business days, confirm the impact, and coordinate a fix and disclosure timeline with you. This is a community project and we do not offer a bug bounty. We welcome good-faith research and will work with you on a disclosure that protects users. Please give us a reasonable window to fix the issue before publishing details.

Safe testing

Test against your own installation, accounts and data.
Do not access, modify or exfiltrate another person’s data.
Do not run destructive tests against shared infrastructure, the public relay or the policy site.
Stop and report if you encounter real user data.

Read the privacy policy, the Chrome bridge policy and the project’s threat model.