Skip to content

Security: agentify-sh/desktop

Security

SECURITY.md

Security

Local-only design

  • The local control API binds to 127.0.0.1 (loopback only).
  • Requests are rejected unless the client is loopback (127.0.0.1/::1).
  • Auth uses a local bearer token stored at ~/.agentify-desktop/token.txt (permissions 0600).
  • The chosen port is written to ~/.agentify-desktop/state.json.

CAPTCHA policy

  • Agentify Desktop does not automate CAPTCHA solving.
  • When a verification challenge appears, automation pauses and requires manual user intervention.

Session data

  • Electron cookies/localStorage are stored in ~/.agentify-desktop/electron-user-data/.
  • Anyone with local access to the machine may be able to access the signed-in session.

There aren’t any published security advisories