SecurityWhat RoachNet protects

Signing

RoachNet 1.1.4 is ad-hoc signed and not Apple-notarized: there's no Developer ID signature yet. macOS blocks RoachNet Setup the first time until you choose Open Anyway, and the SHA-256 check is what stands in for notarization:

shasum -a 256 -c RoachNet-Setup-macOS.dmg.sha256
RoachNet-Setup-macOS.dmg: OK

The iOS companion is an unsigned IPA that SideStore or AltStore signs with your own Apple ID.

The local API

• A token per launch. When RoachNet.app starts the runtime, every route except GET /api/health needs that launch's token or a RoachClaw API token with the right scope. Other programs on your Mac can't drive the API just because they can reach 127.0.0.1. Since 1.1.3 the launch token goes to the runtime on its standard input and stays in memory: it's in no file, and the runtime takes it out of its environment before it starts anything, so the agents and tools it runs don't inherit it. The app sends the token only to the runtime it started: the runtime's server-info file has to name that process and an address on this Mac where it's listening, and a runtime that answers a request without the token is stopped.
• RoachClaw API tokens are shown once and stored only as a SHA-256 hash. Scope them to chat, read or admin, and revoke them in Settings › RoachClaw.
• Loopback only, and no other websites. Every local service accepts only localhost, ::1 and dotted-quad 127.x.x.x in the Host header, and refuses a cross-site Origin, so DNS rebinding and web pages can't reach it.
• JSON only. The loopback API refuses bodies that aren't application/json, so a web page can't post a form at it.

Devices and the companion

• Each paired device gets its own token, kept on the Mac only as a SHA-256 hash and compared in constant time.
• A join code pairs once, expires after 10 minutes and retires after five wrong guesses.
• A device token unused for 90 days stops working, and Linked devices removes one device.
• The companion sends its token only over HTTPS, inside a tailnet, or on the device itself, and asks for Face ID, Touch ID or your passcode before Org decisions, changing the token, or forgetting the Mac.
• The bridge passes only /api/companion/*, so a phone's token can't reach the rest of the API.

State at rest

• RoachClaw state, RoachTail state and the runtime's server-info file are created readable by your account only.
• Since 1.1.3 the companion bridge's token is kept as its SHA-256 only, RoachTail's join code stays in memory with only its hash on disk, and RoachClaw Org signs its run tokens with a key that lives in memory and is new each launch.
• Webhook secrets are stored as salted HMAC-SHA256 digests. Org secrets are never returned by the API or included in exports.
• Traces are scrubbed of secrets before they're written, and stay in files only your account can read.
• RoachBrain's memories and wiki are yours alone: files 0600, folders 0700. Since 1.1.4 an older RoachBrain is tightened the first time RoachNet reads it.
• RoachNet 1.1.4 doesn't encrypt the Vault itself. Turn on FileVault in macOS to encrypt the disk.

Packs, themes and the Dev pane

• Pack archives are read before anything is unpacked. An entry that's absolute, climbs out with .., is a link or special file, or unpacks to the same place as another is refused; ZIP archives are unpacked by RoachNet's own reader; and the archive is merged into the pack's folder without replacing a file that's already there.
• Imported themes keep their background picture inside the theme's own folder, and it must be a picture.
• The Dev pane quotes the folder it types into its shell a Unicode scalar at a time, and doesn't type a folder name that holds a control character or a line separator. Since 1.1.4 it opens and saves a link only when what it leads to is inside the projects folder, writes to that file so the link stays a link, and makes no file or folder outside the projects folder, links included.
• Names and paths are checked a Unicode scalar at a time, as the file system reads them.

Supply chain

• Every file in the bundled speech packs is checked against committed SHA-256 digests at build time, traced to pinned Hugging Face commits.
• Model pulls, packs and map downloads are checked by SHA-256 before they're installed, where the catalog publishes a digest. A RoachSpeech pack the catalog lists must match the catalog's SHA-256.
• The build stamps its source commit into the app. See it in About, or run roachnet-runtime --build-info.

Limits

• No Developer ID signature or notarization yet.
• An Org agent on Full access, or any program you run yourself, runs as you. Since 1.1.3 it can't read the local API's launch token or RoachTail's join code from a file, or the token from the runtime's environment, but it can still read and change your files, RoachNet's included, as you can. Run only programs you trust.
• RoachNet Cluster in 1.1.4 was tested with two runtimes on one Mac, not across two physical Macs. Until a paired Mac has connected since RoachNet started, it waits with every other device for a handshake place, so on a network you share, a device with many addresses can keep it out.
• What goes to a cloud model is your choice (RoachClaw): RoachClaw's local context lanes only if you turn on Cloud models too, and Dev's open file only if you turn on Dev's open file too. A cloud model never gets a memory of a conversation with a model on your Mac. What you do send is seen by that model's provider.

Report a vulnerability

Published advisories are on GitHub. Please don't post security problems in public issues. Email support@roachwares.org. Support has the rest.