Skip to main content
Watchfire
Security

Security you can actually inspect.

Watchfire runs AI coding agents against your source tree. That only works if the containment is honest. Everything that runs is local-first, every agent process is kernel-sandboxed, every change lands in an isolated git worktree, and every line of code that enforces it is open source.

Read the threat modelReport a vulnerability

Four things that are true on every run.

Not aspirations. These are the properties the daemon is built to keep.

  • Local-first by default

    The daemon, your tasks, and your secrets live on your machine. Watchfire doesn't proxy your code through our servers — there are no Watchfire servers. The only outbound traffic is what your chosen agent backend already does.

  • Sandboxed agent runs

    Every agent process is wrapped in a platform-native sandbox — Seatbelt on macOS, Landlock or Bubblewrap on Linux. Credential directories and shell config are blocked at the kernel level, not by an honor system.

  • Isolated git worktrees

    Each task gets its own git worktree on its own branch. The agent can only touch that copy of the repo; merges back to your default branch happen through normal git flows that you review.

  • Open source, auditable

    The daemon, CLI/TUI, and GUI are Apache-2.0 licensed and live on GitHub. Every sandbox profile, signature verifier, and secret-handling path is open for review — and reviewed.

The threat model, in two columns.

Honest about what the sandbox defends against and what it doesn’t. The full version — trust boundaries, signature verification, network exposure — lives in /docs/security.

In scope

What the daemon is designed to defend against.

  • An agent reading or exfiltrating credentials in ~/.ssh, ~/.aws, ~/.gnupg, .env, .netrc, or .npmrc.
  • An agent planting a .git/hooks payload that runs the next time you commit (enforced on macOS).
  • A forged inbound webhook impersonating Slack, Discord, or GitHub to drive the daemon.
  • A replayed inbound delivery executing the same slash command twice.
  • An agent escaping its worktree to scribble over the rest of the repo.

Out of scope

Where the sandbox is honest about its limits.

  • The agent's reasoning itself. If a task prompt tells the agent to delete files in its worktree, it will.
  • A malicious model provider you've configured. Watchfire trusts the backend you point it at.
  • A locally-privileged user who can attach a debugger or read the OS keyring directly.
  • A network attacker who can intercept loopback traffic on a multi-user machine.
  • Windows hosts. The sandbox is not yet implemented there — agents run with your user's full permissions.

What every agent run can — and can’t — reach.

These rules apply to every Watchfire-spawned agent process on macOS and Linux. Windows currently runs unsandboxed; prefer a supported platform for security-sensitive work.

ResourceAccess

Task worktree

.watchfire/worktrees/{n}/ — the agent's working copy

Read / Write

/tmp

Scratch space for tooling and build caches

Read / Write

Rest of the filesystem

Read-only access for compilers, language servers, and lookups

Read-only

Network

Full outbound access — your backend needs to call its model provider

Allowed

~/.ssh, ~/.aws, ~/.gnupg

SSH keys, cloud credentials, GPG keys

Blocked

~/.netrc, ~/.npmrc

HTTP and npm registry credentials

Blocked

~/Desktop, ~/Documents, ~/Downloads

Personal directories outside the project

Blocked

.env files and .git/hooks

Pattern-blocked on macOS (Seatbelt regex denies)

Blocked

Backed by Seatbelt (sandbox-exec) on macOS, Landlock on Linux 5.13+, and Bubblewrap on older kernels. The daemon also strips its internal environment variables before exec, so agents start with a clean environment.

Secrets stay on your machine.

Watchfire never sends adapter credentials, signing secrets, or anything in .watchfire/secrets/ off the machine. There is no Watchfire-operated server in the path.

Integration credentials live in the OS keyring (Keychain on macOS, Secret Service on Linux, Credential Manager on Windows), with a clearly-flagged file-store fallback for hosts without a keyring backend. The IntegrationsService.Save gRPC is write-only on the wire: clients can replace secrets, but never read existing values back over RPC.

Per-project secrets you want the agent to use live in .watchfire/secrets/instructions.md — a file the agent sees read-only via its system prompt. The directory is gitignored by default; it is your file, not ours.

Deeper details: Where Watchfire keeps your secrets walks through the storage layout end to end, and /docs/security covers the signature-verification and outbound-signing path.

Every run leaves a trail you can read.

Watchfire writes everything to disk in formats you can cat, grep, and git log. Nothing is hidden in an opaque database.

  • Task files

    Plain YAML at .watchfire/tasks/ — one file per task, with prompt, acceptance criteria, status, and outcome.

  • Branches & worktrees

    Every task lives on a watchfire/<n> branch in its own worktree under .watchfire/worktrees/. Reviewable like any other branch.

  • PTY transcripts

    The exact bytes the agent saw and sent, captured per task. Replayable in the GUI/TUI or readable directly from disk.

  • Metrics files

    A {n}.metrics.yaml sibling to every task captures duration, tokens, cost, and outcome — structured, diffable, auditable.

Found something? Tell us first.

Please don’t file public GitHub issues for security vulnerabilities — public disclosure before a fix puts every Watchfire user at risk. Email us with reproduction steps and impact, and we’ll coordinate.

Acknowledgment
Within 48 hours
Initial assessment
Within 1 week
Coordinated disclosure
Targeted within 30 days
Credit
In release notes, unless you prefer anonymity
security@watchfire.iosecurity.txtSECURITY.md
Security FAQ

Direct answers to the hard questions.

The ones that come up before a security review signs off.

Can the agent read my SSH keys?
No. On macOS and Linux, the platform sandbox denies read and write access to ~/.ssh, ~/.aws, ~/.gnupg, ~/.netrc, and ~/.npmrc for every agent process. The enforcement is at the kernel level — Seatbelt on macOS, Landlock (or Bubblewrap) on Linux — so it does not rely on the agent being well-behaved.
Does Watchfire send my code to Anthropic, OpenAI, or anyone else?
Watchfire itself doesn’t. The daemon and every client are local-first and have no Watchfire-operated server to phone home to. The agent backend you configure (Claude Code, OpenAI Codex, opencode, Gemini CLI, GitHub Copilot CLI, Cursor Agent) still talks to its own model provider exactly the way it would if you ran it directly — that traffic is between you and that vendor. See /privacy for the full data-flow picture.
What happens if an agent goes rogue?
The blast radius is bounded by three things: the sandbox (no access to credentials or directories outside the project), the worktree (writes land on a watchfire/<n> branch, not on your default branch), and you (nothing merges without a review you triggered). Restart protection also caps runaway loops before they burn through tokens or budget. If something looks wrong mid-run, stop the task — the worktree and branch stay behind for forensics.
Is the sandbox available on Linux?
Yes — Watchfire uses Landlock on Linux 5.13+ and falls back to Bubblewrap on older kernels. Both block credential directories at the kernel level. The one asymmetry: Seatbelt on macOS supports regex patterns and additionally blocks .env and .git/hooksdirectly; Landlock and Bubblewrap are path-based and don’t enforce those two patterns. Full backend matrix lives in /docs/security.
Can I disable the sandbox?
You can, but you have to ask for it explicitly per project — the default is sandboxed. We don’t recommend running unsandboxed for any project you care about; the only legitimate reasons are environments where the platform doesn’t support sandboxing (currently Windows) or short-lived test runs where you need the agent to touch something the sandbox blocks.
Where do I report a vulnerability?
Email security@watchfire.io with reproduction steps and impact. The machine-readable contact lives at /.well-known/security.txt. We acknowledge within 48 hours, complete initial assessment within a week, and target coordinated disclosure within 30 days. Reporters are credited unless they prefer anonymity. Please don’t file public GitHub issues for security reports.
Ready to go

Get started with Watchfire

Install in seconds. Define tasks. Let agents ship code for you.

Download for macOS

Available for macOS, Linux, and Windows

install
# Install via Homebrew (macOS)
$brew tap watchfire-io/tap
$brew install --cask watchfire-io/tap/watchfire
# Set up your project and go
$watchfire init
$watchfire task add "Build the login page"
$watchfire start --all

Includes GUI, CLI, and daemon. Also available via Homebrew.

View on GitHubRead the Docs