Skip to content

Security Notes

Jump to bottom
comfuture edited this page Aug 10, 2026 · 1 revision

Security Notes

  • Codori assumes the host machine is trusted.
  • Codori can start a shared Codex runtime that can act on selected repositories through explicit workspace cwd values.
  • Anyone who can reach your Codori server can potentially interact with that runtime unless you place Codori behind a private network or another access control layer.
  • For remote use, prefer a private tailnet or equivalent private tunnel over direct public exposure.

No built-in authentication

Codori has no application-level authentication. Tailscale Serve keeps the origin private to your tailnet and relies on tailnet access-control rules, so restrict tailnet access to trusted operators. Tailscale Funnel and public exposure are outside the current contract and require the future application-authentication boundary tracked in issue #77.

The immersive WebXR application reuses the same same-origin /api/* routes and does not add authentication of its own.

Bounded file access

File access is read-only and bounded. The server canonicalizes each target and rejects traversal and symlink escapes outside the active workspace root. Absolute paths are accepted outside the workspace only for regular files inside canonical platform temporary directories, and preview size is validated before a read. See Settings and UI for the transcript link policy.

Codori provides no file create, edit, rename, move, or delete operations of its own; changes come from Codex acting inside a workspace.

Avatar assets

Avatar manifests and spritesheets are size-bounded, image dimensions and animation frames are validated, custom paths must remain within their pet directory, and built-in downloads are restricted to the Codex pet CDN.

Voice and microphone

Voice controls are app-scoped: there are no global hotkeys and no background listening. Plain HTTP is supported only on localhost; private remote use requires a secure HTTPS origin supplied outside Codori. Codori does not ask for an OpenAI API key and does not use the direct Realtime WebSocket transport.

Not in scope

Codori is not a VPN, a general ingress proxy, an auth platform, or a deployment layer. Networking remains explicit and under your control.

Clone this wiki locally