Security & current limits

Electron boundary

The renderer runs with sandboxing and context isolation enabled, Node integration disabled, and no webviews. Navigation and new windows are denied outside the app origin. Production assets load through a private c3app:// protocol with a restrictive Content Security Policy.

Only the typed window.c3desktop bridge reaches the main process. IPC handlers use an allowlist and verify the sender frame's origin. Hub networking, SSH, PTYs, detection, setup, service control, and credential operations remain outside the renderer.

Credentials and trust

• Hub transport runs in the main process with the hub CA and SPKI fingerprint pinned.
• Phone and bridge enrollment artifacts are short-lived secrets.
• Temporary bridge bundles are overwritten and removed after import.
• Passwords and passphrases used by setup are session-only and setup output is redacted.
• Forgetting local credentials does not revoke the corresponding hub credential.

Current beta limits

• Linux, macOS, and Windows packages are unsigned. macOS notarization and Windows Authenticode signing are not yet enabled.
• The desktop package lifecycle is natively exercised across Linux x64/ARM64, macOS Intel/Apple Silicon, and Windows x64. Native C3 Bridge service execution on macOS/Windows and Windows snapshot-terminal execution remain qualification gates.
• Launch-at-login, automatic updates, and desktop notifications are marked as later work in the app.
• C3Sync and C3 Bridge are downloaded and checksum-verified on demand rather than embedded. Herdr and coding-agent CLIs must be installed separately.
• Decision buttons that fall back to terminal keystrokes cannot prove how the agent interpreted the keystroke.

For control-plane encryption and hub trust details, also read the C3 Mobile security model.