Security

Security boundary

• Coding agents, repositories, model credentials, prompts sent directly to models, and model traffic remain on the paired computer and their original providers.
• Task messages, questions, commands, approvals, replies, and attachments are encrypted at an authorized endpoint before relay transport.
• The relay stores and forwards ciphertext; it cannot derive endpoint or per-task keys from the information it receives.
• Plaintext is available on authorized endpoints and to tools you intentionally invoke there. Endpoint compromise is outside the protection offered by relay encryption.

Pairing

Pairing uses a random 128-bit mailbox identifier and an independent 256-bit transfer key carried in the QR code or manual token. The transfer key is not sent to the relay. The encrypted pairing blob is single-use and expires after 15 minutes.

Treat a pairing QR code or manual token like a password until it expires. Anyone who obtains it during that window may attempt to pair, so never publish or forward it.

Independent task keys

Each attached task receives an independent 256-bit key generated and distributed through the encrypted endpoint channel. Possession of one task key does not reveal another task key, so access to one task cannot be used to decrypt a different task's ciphertext.

Keys are held in protected local storage on authorized endpoints. They are not stored in relay databases, logs, source code, or Cloudflare secrets.

What the relay and network can observe

This metadata can reveal that a paired endpoint communicated and approximately when or how much data moved. It does not contain the task title, prompt, command, file path, attachment plaintext, reply, or approval decision.

• Opaque room, task, message, delivery, and recipient identifiers needed for routing.
• Connection time, sender and recipient role, expiry, retry state, delivery status, and ciphertext size.
• IP address and ordinary request or security information processed by Cloudflare infrastructure.
• For background delivery, an APNs device token, sandbox or production environment, bundle identifier, and update time.

Background notifications

GrantTap sends APNs a generic wake payload containing only a GrantTap wake flag. Task type, command, prompt, title, path, request identifier, and message body are not put in the push payload. After a wake, the app retrieves encrypted state through the normal task channel.

Apple and network providers can still observe normal notification-routing metadata. APNs delivery and background execution timing are controlled by the operating system and are not guaranteed.

Local protections

• Face ID, Touch ID, or device passcode can gate app access and approvals; GrantTap receives only the system authentication result.
• Notification details can be hidden, and approvals can require fresh authentication.
• A local audit log records relevant actions without uploading that readable history to the relay.
• Forgetting a pairing removes pairing and task keys from the app, after separately clearing any local histories you want removed.

Limits of the model

End-to-end encryption protects task content while it crosses the GrantTap relay. It does not make an unlocked or compromised endpoint safe, validate agent output, prevent an approved command from causing damage, secure third-party MCP servers, or replace encrypted backups and operating-system updates.

Traffic analysis, denial of service, delayed delivery, and the metadata listed above are not eliminated by content encryption. Keep the paired computer and Apple devices updated and remove access you no longer need.

Public audit surface

The machine bridge and relay are public so their transport and key-handling boundaries can be independently inspected. The iPhone and Apple Watch app is proprietary; public source availability for adjacent components is not a claim that the entire product is open source or formally audited.

Report a vulnerability

Use a private GitHub Security Advisory for suspected vulnerabilities. Include the affected component and version, impact, and minimal reproduction. Do not include live pairing tokens, endpoint keys, real task content, or credentials. For a non-security support problem, use the Support page instead.