Security & current limits

Electron boundary

The renderer runs with sandboxing and context isolation enabled, Node integration disabled, and no webviews. Navigation and new windows are denied outside the app origin. Production assets load through a private c3app:// protocol with a restrictive Content Security Policy.

Only the typed window.c3desktop bridge reaches the main process. IPC handlers use an allowlist and verify the sender frame's origin. Hub networking, SSH, PTYs, detection, setup, service control, and credential operations remain outside the renderer.

Credentials and trust

• Hub transport runs in the main process with the hub CA and SPKI fingerprint pinned.
• Phone and bridge enrollment artifacts are short-lived secrets.
• Temporary bridge bundles are overwritten and removed after import.
• Passwords and passphrases used by setup are session-only and setup output is redacted.
• Forgetting local credentials does not revoke the corresponding hub credential.

Current beta limits

• The qualified package is an unsigned Linux AppImage.
• macOS notarization and Windows signing are not implemented release paths.
• Launch-at-login, automatic updates, and desktop notifications are marked as later work in the app.
• Herdr, c3sync, c3bridge, and coding-agent CLIs must be installed separately.
• Decision buttons that fall back to terminal keystrokes cannot prove how the agent interpreted the keystroke.

For control-plane encryption and hub trust details, also read the C3 Mobile security model.