Local-first by architecture

The runtime is a local HTTP server on your machine; the workspace is a browser tab pointed at 127.0.0.1. Credentials, MCP configuration and task notes are stored with owner-only file permissions, and Sonderr rejects symlinked credential and config paths. Secrets are never embedded in command arguments or environment values.

Secret scrubbing

Scrubbing runs at every shared output boundary: chat text, nested tool events, saved conversation history, server-sent events and JSON API responses. It recognizes common provider credentials, credential-labeled fields and URLs, and serialized call-shaped output. Provider error bodies are not echoed to chat, provider and MCP response bodies are size-bounded, and fake text or JSON that resembles a tool call is never treated as an action — only structured tool execution results count. No scrubber is perfect: do not paste credentials into chat, and rotate anything that may have been exposed.

Workspace sandboxing

Workspace tools reject symlinks that resolve outside the workspace or into protected paths — including .env, .sonderr and Git internals. Edits are written through exclusive no-follow temporary files with destination rechecks before atomic replacement. Static UI and documentation routes are constrained to canonical files. Ask mode is visibly read-only, Build mode plus an explicit current-message request is required for workspace changes, and project checks need Full PC access — enforced at the server execution boundary, so a stale or indirect call cannot bypass it.

Required release updates

Since v1.5.10, managed installs verify they are on the latest stable release at startup. A newer release blocks the workspace until it is installed — no "skip this version". The one-click updater downloads the exact release tag, installs locked dependencies, backs up the previous folder and restarts; on failure it restores the previous install. Update diagnostics live in ~/.sonderr/update.log. A release check requires internet access to GitHub; when the check cannot be verified, the app stays locked and offers retry rather than treating an unknown version as safe. Release tags are not cryptographically signed by this updater — review the source if your threat model requires signed artifacts.

Web safety

Built-in web research makes bounded, read-only public HTTPS requests: local and private hosts are blocked, DNS answers are pinned after validation, non-text downloads and oversized pages are refused, and generated-image URLs are fetched only from public HTTPS destinations with DNS pinning, strict image types and a 16 MB limit. HTTPS MCP requests are pinned to validated public DNS answers, reject redirects and block IPv6 transition targets that could reach private networks.

Wallet safety — read this twice

Sonderr Wallet is experimental and is not recommended as a primary wallet. Keep no more than €100 total (or equivalent) in it while testing, back up the encrypted wallet, and assume bugs or mistakes can permanently lose funds. Every transfer and swap creates a visible chat review card — chain, sender, recipient, exact token address, base-unit amount, fee estimate and expiry — and nothing is signed or broadcast until you press Accept & send or Accept & swap on that exact card. No auto-trading, no copy trading, no unattended execution, ever.

Report a vulnerability

Found something? Do not open a public issue. Use the Responsible Disclosure process or email dxn1.0day@gmail.com directly — security reports skip every queue. We credit reporters by default and move fast.