Security model
CodeRail lets the people you choose control your computers, so it's built to keep that power where you put it.
Where things run
- The server is yours: a Worker, a D1 database and Durable Objects in your own Cloudflare account, on your domain.
- The bridge on each computer only makes outbound connections to your server. It opens no ports.
- The agents run with their own logins on each computer. CodeRail never sees or stores AI credentials.
Accounts
- Passwords are hashed with PBKDF2-SHA256.
- Sign-in sets an HttpOnly, Secure session cookie; sessions are stored hashed.
- Requests that change something must come from your site's own origin.
- After the first admin, people join only by invite.
Computers
- A computer is linked by a short code that a signed-in person approves in the browser.
- Each computer then gets a long random token, stored only hashed on the server, and in
~/.coderail/config.json(readable only by you) on the computer. - Removing a computer revokes its token and disconnects it at once.
Permissions
Every request is checked against the person's role on that computer by the server, and folder limits again by the computer, after resolving symlinks. The bridge never lets anyone reach its own folder (~/.coderail). See Roles and permissions.
Previews
Dev-server previews are served from a separate hostname (PREVIEW_HOST), with a short-lived signed pass per computer and port, so a previewed app can't read your CodeRail session.
What your server can see
CodeRail is not end-to-end encrypted. Your server relays session content and keeps each session's history so you can replay it. That's a deliberate trade for continuity, on a server you control.
Builds
- The Mac app and the macOS bridge are signed with a Developer ID and notarized by Apple.
- Mac app updates are signed with an EdDSA key; the app installs only updates signed with it.
install.shchecks each download against its SHA-256 checksum.
Reporting a vulnerability
Please report it privately: github.com/wiva-hq/CodeRail/security/advisories/new.