Security and trust boundaries

Worktree's current sharing model combines host-approved device access, a project-scoped API boundary, and encrypted transport. This page describes that model; it is not a compliance certification or a claim that the software cannot have security bugs.

Project access

The host approves each device and controls its project permissions. Shared requests are checked against the granted directory and owned sessions. The gateway rejects unrelated projects, host administration, and provider credential APIs. File paths are checked for canonical containment, including symlink or junction targets.

The desktop uses random authentication credentials for its loopback APIs. A local address alone is not treated as authorization.

Transport and coordination

Project traffic travels through a relay inside mutually authenticated TLS with retained peer key pins. The relay forwards encrypted application records. The coordinator stores sharing metadata such as device labels, public certificates, credential hashes, approval state, invitations, and leases; it is not this feature's transcript or file store.

The coordinator is trusted for initial discovery and approval. An invitation code is not independent verification against a malicious coordinator. Connections and frames are bounded, and leases enforce continuing authorization. Revocation is not instantaneous and does not undo completed reads or writes.

AI credentials

Each participant's provider keys and OAuth tokens stay in their device-local provider runtime. The host runner receives model results, not those credentials. Requests still send the relevant conversation and project context to the provider chosen by the sender. Do not put secrets into prompts or shared files unless everyone and every service that receives them should have access.

Execution is trusted

Commands, terminals, plugins, MCP processes, and executable project configuration run with the host user's operating-system privileges. Worktree does not provide an OS sandbox for these processes. An approved command can reach data outside the shared folder.

In this alpha, Agent shell Off and Ask disable ordinary file editing and terminals. Ask can still approve individual commands. On is intended for trusted collaborators. Review the permission guide before enabling execution.

Release status

The alpha has received source review, regression testing, and controlled live sharing checks. Those checks are not an independent security certification or a substitute for testing the final signed release artifacts. Automatic updates remain disabled until a Worktree-owned signed update channel is ready.

For a Worktree issue, contact the project without including API keys, passwords, invitation codes, or private files. The app's OpenCode community link leads to the upstream community; it is not Worktree-specific support.