Security and privacy for developers

Koder and KARMENBOT run on your computer. Keys and settings stay local. Review the selected approval mode before allowing edits or commands.

Keys

• Enter API keys and GitHub tokens in settings, never in chat.
• Keep SDK keys in environment variables or a credential store, not source code.
• When public API tokens become available, keep them on your own computer, never in web page source. They cannot read model keys.

Approvals and permissions

See approval modes. Accepting a license enables no optional permissions.

Network requests

KARMENBOT version checks do not send keys or files. Interactive Koder CLI chats check for official updates at most once every six hours. Model requests go directly to your configured provider.

Third-party authorization

Disconnecting a plugin in Koder does not revoke authorization on the other service. Revoke it on that service’s website.

Report a security issue

See security.txt for contact details and security patches for published fixes.

Licenses

Koder CLI is free for personal, noncommercial local use. Its proprietary code is covered by the EULA and may not be modified or used for secondary development. KARMENBOT terminal source is GPL-3.0-only with a linking exception. Koder SDK is MIT. The proprietary KARMENLOOP kernel is distributed separately.