4 MINUTE READ
Security
The local trust model and the limits it is designed around.
Local daemon access
The daemon binds to 127.0.0.1. API calls require a bearer token stored in a private config file. Browser bootstrap is limited to the configured local Origin. Host validation reduces DNS rebinding exposure, and WebSocket access requires the daemon token.
The UI device lock is a convenience privacy screen, not an independent authentication boundary. A process with access to your user account and config file can access Loom. Protect your operating-system account and do not share your daemon token.
Agent execution is trusted code
Git worktrees isolate repository changes, not process capabilities. Agents and approved project commands execute with your user privileges. Malicious repository instructions, package scripts, or model output can still attempt unsafe operations.
Review plans and permission requests. Use OS containers or another restricted environment when the repository or its scripts are not trusted.
Release integrity
The updater accepts HTTPS artifacts only from the official repository's versioned GitHub releases. It validates manifest shape, file size, and SHA-256 before using an executable. Updates are applied by a copy of the current executable, and a failed health check triggers rollback.
Checksums protect against corrupt or substituted downloads relative to the trusted manifest. They do not protect against a compromised maintainer or GitHub release account. Release workflow permissions and repository protection are part of the trust boundary.
Report a vulnerability
Use the repository's private vulnerability reporting option when available. Do not put live credentials or exploitable private-system details in a public issue. See SECURITY.md in the repository for the reporting policy.