Security overview
What Harmony protects, what it explicitly does not, and where the trust boundaries actually sit.
This page is written to be useful during an incident, which means it is more interested in the boundaries than in reassurance.
What Harmony is
A local-first application. The daemon, terminals, tasks, agent-to-agent messaging, voice models, and MCP integration run on your machine. There is no cloud host in the path of your work, and local use does not require an account.
What Harmony protects
| Protection | Detail |
|---|---|
| Download integrity | Installers and updates verify exact byte size and SHA-256 before executing |
| Release honesty | Unsigned builds can reach the preview channel only, and are labelled |
| Approval gates | Actions that change your machine or repository can require explicit consent |
| Credential isolation for managed harnesses | User-managed external harnesses do not share credentials with other providers |
| Remote message containment | LAN Link messages render as text only; never pasted into a PTY, never routed to an execute path |
| Schema-validated IPC | Inter-process messages are validated rather than trusted |
What Harmony does not protect
Being explicit here matters more than sounding secure.
SECURITY
Extensions, skills, and plugins are not sandboxed by default. Third-party extension code runs with the privileges of the process that loaded it. Do not install extension code you would not run directly.
| Not protected | Why it matters |
|---|---|
| Agent actions within a worktree | Worktrees are file isolation, not a security boundary |
| Your provider credentials | Harmony does not hold them; the provider does |
| Your shell environment | Keys exported globally are visible to everything you run |
| Content produced by a model | Treated as untrusted input, not as instruction |
| Repository content | A repository can contain hostile text aimed at an agent |
| Browser content | Anything a browser surface loads is untrusted |
Untrusted inputs
Treat all of these as attacker-controlled:
- Model output
- Repository file contents
- Web pages loaded in a browser surface
- Extension and skill code
- Provider output
- Messages received from peer machines
The practical consequence: an approval prompt is not a formality. It is the last point where a bad instruction that entered through any of the above is cheap to stop.
Windows signing status
The Windows preview build is not Authenticode signed. SmartScreen will warn, and that warning is correct.
SECURITY
Verify the published SHA-256 yourself rather than disabling SmartScreen. Turning off a machine-wide protection to install one application leaves the machine weaker permanently.
Reporting a vulnerability
Report security issues privately rather than in a public tracker, and include enough detail to reproduce. Do not include credentials or customer data in the report.