# Security

Updated: October 20, 2026

This document describes the security design of the Koder desktop app and the KARMEN LOOP kernel that ships with it (together, “the software”), what you should watch for while you use it, and how security patches, software updates, and security reports work. It describes what the current version actually does. When the version changes, we update this document and the updated date.

## 1. The overall design

1.1 It runs locally. The software runs on your computer. It does not require an account. It does not offer cloud sync. It does not upload telemetry. Your tasks, chats, files, and keys stay on this computer. Our servers do not store them.

1.2 It serves only this computer. The interface is a local web service that listens only on the loopback address 127.0.0.1. Other devices on the local network or the internet cannot reach it. The software checks the origin of each request and refuses a cross-site request started by another website in your browser, so a malicious page cannot drive the software through your browser.

1.3 The shell and the kernel are separate. The software is two processes: the interface shell and the KARMEN LOOP kernel. The kernel listens only on a random local port, and every request must carry a token. The token is stored in a file only the current system user can read (mode 0600), and it is generated again at every start. Another program on this computer can find the port and still cannot call the kernel without the token. If the kernel exits unexpectedly, the shell restarts it on a growing interval. If it keeps failing in a short time, the shell stops restarting it and says so in the interface.

## 2. Keys and credentials

2.1 Stored encrypted. API keys for model services are kept in the kernel’s encrypted key store, using AES-256-GCM. The key file used for that encryption can be read only by the current system user. A website username and password saved through the lock box are stored with AES-256-GCM as well.

2.2 Not read from the environment. The software does not read a model key from an environment variable or from a .env file. When the shell starts the kernel, it clears environment variables whose names look like keys, so they are not used by accident.

2.3 Not shown in the interface. The interface does not show any part of a key, and the interface API does not return a key to the interface. When you read the live model list, a new key you typed in the form is used for that one read. It is saved only after you click Add.

2.4 Not in the system keychain yet. The encryption key file currently lives in the software’s data folder. It is not in the macOS Keychain or in Windows Credential Manager. Protect your system account, and do not copy the data folder to someone else.

## 3. The boundary around what the AI does

3.1 A file write waits for you. A command asks by default. Before the AI writes or edits a file, the software shows the before and after. It writes only when you click Accept. A change you reject is not written to disk. A command shows the full text and asks every time, by default. A command you use often can be set to Always allow, and you can also set commands to run on their own in Settings. Deleting files, raising privileges, disk operations, shutdown and restart, force-push and rewriting version history, and handing text to a command interpreter always ask, no matter the setting. A command you reject does not run.

3.2 A file-access boundary. The KARMEN LOOP kernel turns on a file-access boundary for commands. The default mode is “workspace writable.” No isolation measure is absolute. Still read every command.

3.3 Read-only mode and tool switches. You can set the chat to Ask, which is read-only. The AI can then read and search, and it cannot write a file or run a command. You can also set the tool set to Minimal, or turn any tool off on the Tools page. Those settings take effect on a task that is already running.

3.4 A question times out. If you do not answer a question from the AI within 60 seconds, the software cancels that question. The AI continues on a reasonable assumption and does not hold resources while it waits. You can still add an answer later. A change or command waiting for you is kept for 30 minutes at most. After that it counts as a no.

3.5 KARMEN only chats. KARMEN bot does not use any tool. It cannot read or write your files or run a command.

3.6 A known limit. Automatic accept covers only ordinary files in the current task folder. Keys, files inside `.env` and `.git`, and commands such as delete and privilege changes still need you.

## 4. Network security

4.1 Model requests. The software sends a request only to the model endpoint you configured. That address accepts only http and https, and it cannot include a username or a password.

4.2 Fetching a page. When the AI fetches a page, the software allows only public http and https addresses. It resolves and checks every target, and it refuses local and private-network addresses, so the AI cannot be steered into a service on your internal network.

4.3 Prompt injection. A web page, a file, or a tool result can contain text that tries to steer the AI. The confirmation before a file write or a command is the last line against that. Do not allow an action whose source or purpose is unclear.

## 5. Software updates and security patches

5.1 Security patch level. The System page shows the software’s security patch level, which is the date of the latest security fix included in the software. The current security patch level is October 9, 2026.

5.2 Integrity of an update. The software accepts only update notes signed with Ed25519. The public key used for that signature ships with the software. An update package is downloaded over HTTPS, and the SHA-256 of each file is checked. An update package can replace files only in the software’s code directory. It cannot write into the data folder or anywhere else. Before it installs, it backs up the files it will replace, and you can roll back in one step if something goes wrong. An update package whose signature or digest does not check is refused.

5.3 What the AI does here. The AI only explains the update to you. It does not download, check, or install it.

5.4 Where things stand. The official site and the update address are not online yet, so the software does not check the network for updates. When they are online, this document will name the update address and the security-advisory page.

## 6. How to use it safely

6.1 Protect the computer. Set a system login password, turn on disk encryption, install the operating system’s security updates, and do not run everyday programs as an administrator for long stretches.

6.2 Protect your keys. Enter a key only in the model settings or in the lock box. Do not write a key into a chat, a file, or a command. If you think a key has leaked, revoke it at the provider and replace it in the software.

6.3 Read each confirmation. Read the command and the change before you click Allow or Accept. Be especially careful with deleting files, changing system settings, downloading a program and running it, and raising privileges.

6.4 Pick the folder. Add only the folders you want the AI to work in. Do not let the AI work in a directory that holds private keys, identity documents, or financial records.

6.5 Back up what matters. Use version control or a regular backup for an important project.

6.6 Third-party services have their own risk. Content you send to a model service is handled by that provider. Choose the service with the sensitivity of the content in mind.

## 7. Reporting a security issue

If you find a vulnerability in the software, tell us privately. Do not publish the details in public. Provider: KARMENLOOP Official Team. Team location: Shanghai, China. Security contact email: info@karmenloop.com. After we receive a report we will confirm, assess, and fix it as soon as we can, and we will thank you in public after the fix ships if you agree. After the official site is up, we will publish a security-advisory page and the process for handling reports.

## 8. Security of open-source components

The software includes open-source components. The list, the versions, and the sources are in the Open-source notice. We watch security issues those components publish, and we update an affected component through a security patch.