Security

The bridge gives a paired phone control over the coding agents on your computer and, if you allow it, a shell. Here's what protects that, what leaves your computer, and what to keep in mind.

No cloud relayThe phone talks straight to the bridge on your computer, over your network or Tailscale. There's no account and no server of ours in between.
Only your computerThe pairing code carries the bridge's certificate fingerprint. The app refuses any server that isn't your bridge, even on a network you don't trust.
Scoped devicesEach phone gets its own token and permissions, and you can revoke it from the computer at any time.
Secrets maskedAPI keys, tokens and passwords are masked before anything leaves the computer, push notifications included.

The connection

The connection between your phone and the bridge is encrypted. Other devices on your network can see the bridge is there, but they can't do anything with it unless they've been paired.
The QR code you scan to pair includes your bridge's fingerprint, so the app only ever talks to your computer. A look-alike server is refused.
The bridge goes online for only two things: sending push notifications, if you turn them on, and checking once a day whether a new version is out. You can turn off the update check.
If you use Tailscale, you can make the bridge reachable only through it, so nothing else on your Wi-Fi can reach it at all.

Pairing and devices

A pairing code is 10 random characters (50 bits), valid for 5 minutes and usable once.
Failed attempts are limited to 5 per address and 20 overall in any 10 minutes. Past that, pairing is refused, even with the right code, until the window passes.
Each paired phone gets its own secret key. The bridge keeps only a scrambled copy of it, so the key can't be read back off your computer.
Every connection has to authenticate before anything else.
droidtty-cli devices lists paired phones. droidtty-cli revoke <device> removes one and closes its open connections at once.

Permissions

Each device's permissions are fixed when it pairs (droidtty-cli pair --scopes …). All four are on by default.

readEverything the apps show: workspaces, conversations, diffs, files, events

respondAnswering approvals and questions

controlMessages to agents (steer and queue), stopping them, permission modes, starting agents, installing Herdr integrations

terminalOpening shells and typing into them; also needed to start a plain shell from the phone

A phone with terminal can run anything your user can. Treat a paired phone like an SSH key: pair only phones you own, and revoke one you lose.

Guardrails on what a phone can do

When you approve a command or answer a question, the answer goes through Herdr, not typed into the terminal, so it can only ever answer that one prompt. If your phone is offline, nothing is saved up to send later: the answer arrives right away or not at all.
A message you send can't accidentally answer an open approval or question; the bridge refuses it.
When you start an agent from the phone, you pick from the agents and options the bridge offers. The phone can't slip in a command of its own. Options that let an agent skip its permission prompts are marked, and the app asks you before using them.
Everything a phone does (approvals, answers, messages, agents started) is logged with the phone's name. Run droidtty-cli audit to see it.

What leaves your computer

Before anything reaches your phone, anything that looks like a secret is masked: API keys (OpenAI, GitHub, AWS, Stripe, Slack, Google, npm, Hugging Face and more), access tokens, private keys and passwords. That includes the agent's terminal and notifications. It's on by default, and you can turn it off.
Not masked: a shell you open yourself in the Terminal tab.
Previews of local web servers open with a one-time ticket valid for a minute, then a cookie for that preview only.
With Firebase push set up, notification titles and bodies pass through Google: masked, but readable (for example, the command an approval asks to run). Without push, the apps hear about events over their own connection.

On the computer

The bridge keeps its data in ~/.config/droidtty, which only your user account can read.
Files attached from a phone go in a private folder and are deleted after 7 days.
droidtty-cli claude-status install changes Claude Code's status line in settings.json (backed up first) so the bridge can read plan limits and the prompt cache. uninstall puts the previous one back.

On the phone

The device token is kept in the Android Keystore or the iOS Keychain.
Android app backups are off, so the token doesn't leave the phone that way.
An optional biometric lock protects the app.
Android hides notification content on the lock screen.

Reporting a vulnerability

Please email inbox@diego.earth rather than posting it publicly. Include what you found and how to reproduce it.