Trust

A New Era in Computing Security

For the past 20 years, security models have been built around locking devices and applications down - setting boundaries between inter-process communications, separating internet from local, sandboxing untrusted code. These principles remain important.

But AI agents represent a fundamental shift.

Unlike traditional software that does exactly what code tells it to do, AI agents interpret natural language and make decisions about actions. They blur the boundary between user intent and machine execution. They can be manipulated through language itself.

We understand that with the great utility of a tool like CoderClaw comes great responsibility. Done wrong, an AI agent is a liability. Done right, we can change personal computing for the better.

This security program exists to get it right.

Context

CoderClaw is an AI agent platform. Unlike chatbots that only generate text, CoderClaw agents can:

• Execute shell commands on the host machine
• Send messages through WhatsApp, Telegram, Discord, Slack, and other channels
• Read and write files in the workspace
• Fetch arbitrary URLs from the internet
• Schedule automated tasks
• Access connected services and APIs

This capability is what makes CoderClaw useful. It's also what makes security critical.

AI agents that can take real-world actions introduce risks that traditional software doesn't have:

1. Prompt injection - Malicious users can craft messages that manipulate the AI into performing unintended actions
2. Indirect injection - Malicious content in fetched URLs, emails, or documents can hijack agent behavior
3. Tool abuse - Even without injection, misconfigured agents can cause damage through overly permissive settings
4. Identity risks - Agents can send messages as you, potentially damaging relationships or reputation

These aren't theoretical. They're documented attack patterns that affect all AI agent systems.

Scope

This security program covers the entire CoderClaw ecosystem. Nothing is out of scope.

Core Platform

• CoderClaw CLI and Gateway (coderclaw)
• Agent execution engine
• Tool implementations
• Channel integrations (WhatsApp, Telegram, Discord, Slack, Signal, etc.)

Applications

• macOS desktop application
• iOS mobile application
• Android mobile application
• Web interface

Services

• CoderClaw Skills - Skills marketplace and registry
• Documentation (docs.coderclaw.ai)
• Any hosted infrastructure

Extensions

• Official extensions (extensions/)
• Plugin SDK and third-party plugins
• Skills distributed through CoderClaw Skills

People

• Core maintainers and contributors
• Security processes and response procedures
• Supply chain and dependency management

Program Overview

We're establishing a formal security function with four phases:

Phase 1: Transparency

Goal

Develop and publish our threat model openly, inviting community contribution, so users understand the risks and can make informed decisions about their deployments.

Why

Security through obscurity doesn't work. Attackers already know these techniques - they're documented in academic papers, security blogs, and conference talks. What's missing is clear communication to users about:

• What risks exist
• What we're doing about them
• What users should do to protect themselves

By developing the threat model openly, we benefit from collective expertise and build trust through transparency.

Threat Model Coverage

Threat Model Scope

Each risk in the threat model will include description and severity rating, attack examples, current mitigations, known gaps, and user recommendations.

The threat model will be open for community contribution via pull requests.

Phase 2: Product Security Roadmap

Goal

Create a public product security roadmap defining defensive engineering goals, tracked as GitHub issues so the community can follow progress, provide input, and contribute.

Defensive Engineering Goals

Specific priority issues will be identified through the Phase 3 code review and added to the public roadmap as they are discovered and triaged.

Phase 3: Code Review

Goal

While the community is already working around the clock to find and address flaws - and we're grateful for every contribution - we recognize this is an open-source project where contributors provide their best effort. Phase 3 is a dedicated, comprehensive security assessment specifically designed to drive out deeply rooted systemic issues and improve overall code quality and user safety.

Scope

The code review covers the entire CoderClaw codebase and ecosystem:

Approach

1. Manual code review - Human-in-the-loop analysis of security-critical paths
2. Automated scanning - Static analysis, dependency auditing, secret detection
3. Dynamic testing - Attempting documented attack patterns against running system
4. Architecture review - Evaluating trust boundaries and data flows

Disclosure

• All critical and high findings fixed before public disclosure
• Findings summary published after remediation
• Full report available on request
• CVEs assigned where applicable

Phase 4: Security Triage Function

Goal

Establish a formal process for receiving, triaging, and responding to security vulnerability reports.

Response SLAs

Our Commitments

• Acknowledge all complete reports within 48 hours
• Provide status updates at least every 14 days
• Credit researchers in advisories (unless anonymity requested)
• Not pursue legal action against good-faith security research
• Consider bounties for qualifying critical/high findings (case-by-case)

Security & Trust

Sean Hogg leads Security & Trust at CoderClaw.

Sean oversees threat modeling, secure architecture, vulnerability response, and rollout of practical controls such as optional TOTP MFA, recovery codes, session/token revocation, and legal-compliance controls across CoderClaw services.

Responsibilities

• Lead threat modeling and risk assessment
• Scope and oversee code review
• Establish triage process and response procedures
• Review security-critical code changes
• Provide guidance on security architecture decisions

Recent Security Enhancements (Q1 2026)

• Terms/version enforcement: users must accept the currently active Terms version before accessing protected application areas.
• Versioned legal documents: Terms of Use and Privacy Policy are now versioned and published with timestamps.
• Tracked legal acceptance: accepted Terms version is recorded per user and re-consent is required after Terms updates.
• Superadmin legal controls: platform admins can publish new Terms versions and immediately enforce re-acceptance.
• Expanded account defenses: MFA, session visibility/revocation, and token lifecycle controls are integrated across web, tenant, and admin surfaces.

Current Security Posture

CoderClaw already has security controls in place. Understanding what exists helps users configure their deployments appropriately.

Secure by Default

Verify Your Setup

coderclaw security audit --deep

Key items to verify:

• DM policy is pairing or allowlist (not open)
• allowFrom is configured for your channels
• Exec security is not set to full unless intended
• Gateway is bound to loopback or behind authentication
• Workspace doesn't contain secrets

Timeline

WEEK 1-2: Phase 1 - Transparency
├── Threat model development begins (open for contribution)
├── Security configuration guide drafted
├── Visual overview created
└── Announcement posted

WEEK 3-4: Phase 2 - Product Security Roadmap
├── GitHub issues created for defensive engineering goals
├── Security label and milestone set up
├── Community input period opens
└── First security work begins

WEEK 5-8: Phase 3 - Code Review Preparation
├── Scope finalized (entire codebase)
├── Review begins
└── Initial findings

WEEK 8-12: Phase 3 - Code Review Execution
├── Manual review completed
├── Findings documented
├── Remediation for critical/high
└── Verification completed

WEEK 8+: Phase 4 - Triage Function
├── security@coderclaw.ai live
├── PGP key published
├── Disclosure policy published
└── First advisories (if needed)

ONGOING:
├── Monthly security updates
├── Continuous threat model refinement
├── Regular dependency auditing
└── Community engagement

FAQ