Security

Report a problem

Use GitHub's private vulnerability reporting or write to aditya@usewsp.com. Say which version, how to reproduce it and what it lets someone do. We reply within a week. Please do not open a public issue first. Fixes go into the latest release.

In scope: the desktop app, the host, the command line, the MCP server, the daemon on computers you add, the relay and usewsp.com.

How the parts connect

• The host listens on 127.0.0.1 and asks for a token kept beside its state. Once you add a computer, it also listens on port 4420.
• The daemon on a computer you add listens only on that computer's loopback and dials out to your host. Each link opens with an ed25519 handshake against a pinned key, and every message after it is sealed with AES-256-GCM.
• The daemon runs as root on that computer, and every workspace there can read its home folder.

Keys

Your keys live in a file only your user can read. They are not encrypted, and wsp never writes them to your Keychain. wsp hands them to the threads that need them, on your Mac and on computers you add.

The relay

A connection through the relay passes through a Cloudflare Tunnel, which ends encryption at Cloudflare and lets Cloudflare read it. Reach your computers over your own network or SSH to avoid it. Your own relay takes us out of the path, not Cloudflare.

Releases

Releases are built by GitHub Actions from tags. The install script and the app's self-update check each download's sha256, and the npm package carries provenance. The Mac app is signed ad hoc and the Linux AppImage is unsigned for now.