Skip to content
Get Brompter

Reference

Security

The backend is a local process. Tokens, workspace roots, and MCP commands are checked before a turn starts.

Token

A bearer token is required on /devchat/* except health. The server refuses to start if it is bound to a non-loopback address, or if CORS is *, and the token is missing. The desktop shell generates a fresh token per launch and keeps it in the handshake file.

Files on disk

  • Secrets-bearing files, including runtime settings and MCP config, are written so only the owner can read them.
  • A workspace path must sit under DEVCHAT_WORKSPACE_ROOT_ALLOWLIST when that list is set, and must pass the hard blocklist.
  • HTTP MCP changes run only for commands named in DEVCHAT_MCP_COMMAND_ALLOWLIST. A global server cannot be created over HTTP.
  • The subprocess environment is an allowlist. The parent process environment is not forwarded whole.

Feedback from the desktop app posts to this site’s feedback endpoint. The local backend does not store those reports. A report can include a screenshot and, for a bug, the console buffer. Details are on the privacy page.