Security & Privacy

Fully local, zero telemetry

No cloud, no accounts, no analytics, and no network calls beyond an optional signed updater check. 13x does not upload your code, commands, or snapshots. The only outbound capability is the Tauri updater, and its endpoint is still a REPLACE_ME placeholder in tauri.conf.json, so no live update or tracking traffic ships in this build.

No hidden commands

Every executed command is either typed visibly into a shell you launched or shown in the Resume Plan before it runs. Startup commands live in the rig JSON and run only for slots you explicitly mark auto-start; the backend types them exactly as if you had entered them yourself. There is no silent auto-application.

Secrets are redacted before they touch disk

redactSecrets / redact_secrets (mirrored in TypeScript and Rust) strip known token shapes from any command before it is written into a Rig Checkpoint, resume plan preview, or audit log. 13x also does not store environment variables or .env contents in checkpoints.

Redaction covers these token shapes

• →API_KEY / SECRET / TOKEN / PASSWORD = … assignments
• →Bearer tokens
• →sk-… tokens
• →ghp_… tokens

Dangerous-command gate, enforced on both sides

isDangerousCommand / is_dangerous_command flags commands such as rm -rf, git push, force-push, publishes, kubectl apply/delete, terraform apply/destroy, drop database, and docker prune. The frontend opens a blocking dialog; the Rust backend independently re-validates and rejects the resume with 'ERR: dangerous command not confirmed' before stopping any running PTY, so the UI is never the only line of defense.

Local, append-only audit trail

Every resume attempt is recorded to .13x/snapshots/audit.jsonl: saves, plans, rejected resumes, executed resumes, selected slots, confirmed-dangerous slots, per-slot failures, and the 13x app version. This gives a file-based, auditable policy surface with no change to PTY behavior. List it via list_resume_audit or inspect the file directly.

Tight Tauri capability surface

The single capability (capabilities/default.json) grants only core, window destroy, dialog, updater, and process permissions. No fs, shell, or http plugin permissions are exposed to the webview. main.rs registers only the dialog, updater, and process plugins.

Hardened shell launch

terminal_manager.rs::validate_cwd rejects empty, nonexistent, or non-directory paths before opening a PTY. The only process spawned is a shell resolved by shell_resolver.rs (pwsh, then powershell.exe on Windows; pwsh from well-known dirs then the user's $SHELL as a POSIX fallback on macOS/Linux). path_env.rs repairs the GUI-launch PATH once at startup by querying the login shell with a timeout-bounded subprocess, so the app does not silently fall back to unexpected binaries.

Resume safety controls

• →Resume Plan preview — before any resume runs, 13x shows a plan listing every slot, its resume mode, and a redacted command preview, so nothing executes that you have not seen.
• →Dangerous-command confirmation — slots matching the danger heuristic require explicit per-slot confirmation, or the backend rejects the resume.
• →Rerun Last Command opt-in — Rerun-Last-Command slots are never selected by default and always require explicit confirmation, preventing accidental replay.
• →Replace-running-grid consent — if a grid is already running, resuming requires explicit confirmation before current shells are stopped and replaced.
• →Auto-start toggle — a slot's startup command runs on launch only when its auto flag is set; leave auto off to just open a shell with no command run.

Keyboard shortcuts

• →Ctrl + K — Kill all shells; opens a confirm dialog so you cannot wipe the grid accidentally.

Where your data lives

• →.13x/snapshots/audit.jsonl — append-only resume audit log: snapshot saves, resume plans, rejected and executed resumes, selected slots, confirmed-dangerous slots, per-slot failures, and the app version.
• →.13x/snapshots/ — local Rig Checkpoints (and latest.json); command fields are secret-redacted before write. Does NOT store environment variables or .env contents.
• →.13x/context-packets/ — locally generated context packets (Markdown + JSON); references and symbols only, no full file contents, never uploaded.
• →.13x/decisions.jsonl — Config Advisor decision log (append-only); per the spec, the classifier model name and keys are never logged.
• →<app config dir>/com.thirteenx.desktop/rigs.json — saved rigs (path, layout, slot names/roles, visible startup commands). No cloud, no accounts.
• →Add .13x/ to your project's .gitignore if you do not want this data tracked.

Signed auto-update (placeholder endpoint)

Updates are delivered through the Tauri updater and verified against a bundled minisign public key, so only signed releases install. Status: partial. The updater endpoint in tauri.conf.json is still the literal placeholder https://REPLACE_ME/13x/latest.json, so auto-update is not wired to a live server in this build and no update traffic ships.

Limitations

These are honest gaps in the current build, not finished guarantees.

• →The dangerous-command detector is a heuristic (substring + word-token match). It can miss novel destructive commands or flag benign ones (e.g. any token 'deploy', 'migrate', or 'rm'). It is a speed-bump, not a sandbox.
• →Secret redaction is regex-based and covers known token shapes only; other secret formats can slip through into local files.
• →Commands you type live into a terminal are not redacted or gated, by design — it is a real shell. Secrets and dangerous gating apply to the resume/checkpoint path.
• →CSP is null in tauri.conf.json (no Content-Security-Policy is set for the webview).
• →The website privacy policy is an unfilled GDPR placeholder; controller, hosting, waitlist, analytics, and local-app data handling are all bracketed [TODO] and must be completed before publication.
• →The updater endpoint is the REPLACE_ME placeholder, so auto-update is not connected to a live server.
• →13x does not encrypt local .13x/ files at rest; retention, backup, and enterprise policy enforcement are expected to be layered on top externally.