Security

Keyring

API keys, Bedrock / Vertex secrets, extension secrets, and the GitHub integration token are stored in the operating system keyring. The service name is Spirit.

Provider keys written by the connect wizard use the account scheme provider::{id} — one per provider entry in config.json — or provider::{id}::{slot} for composite credential slots such as Bedrock IAM or a Vertex service account. Large secrets may be sharded in the keyring.

config.json holds provider entries and model refs, not the secrets themselves — unless you opt into a declared escape hatch: a plaintext apiKey (not recommended), an apiKeyEnv environment-variable reference, or an apiKeyKeyring / per-slot keyring reference to an entry in an external keyring. See Config.

Approvals

See Approvals. Default is the safe starting point. Bypass still stops for ask_questions and hook ask.

Local daemon

Desktop and the CLI share a daemon that binds 127.0.0.1 on a random port. Clients send Authorization: Bearer using {spiritDataDir}/server.token (mode 0600).

0.0.0.0 remote access is not an open product path. Do not treat a LAN bind as a hosted cloud agent.

Web Host pairing is a separate 6-digit code on Desktop. Five failures lock the code until you restart Web Host. See Desktop.

Privacy

Spirit does not ship developer telemetry. Data stays in the data directory and the keyring. See PRIVACY.md in the repo.

Report vulnerabilities privately (GitHub Private Advisory), not in a public issue. See SECURITY.md.