Security

neondeck is local-first, but it still handles provider keys, GitHub tokens, local git checkouts, model-visible tools, and optional host execution. Treat the runtime home as sensitive local state.

Secrets

Secrets live in runtime-home .env or process environment variables. Normal config stores environment variable names only. Do not put secrets in config.json, runtime skills, SOUL, or dashboard config.

Provider credentials

Hosted model providers use API credentials or platform bindings. A ChatGPT or Codex subscription login is not a documented Flue provider credential path. Provider config is allowlisted for KiloCode, OpenAI, and Anthropic and stores environment variable names rather than raw secrets.

GitHub token

GitHub API calls run server-side. The browser receives sanitized PR, check, watch, and summary data; it does not receive the token.

Runtime skills

Runtime skills are trusted local extensions. They are guidance, not a place to store credentials. Adding arbitrary external skill roots gives the agent new procedural knowledge and should be treated like editing local agent configuration.

Execution approvals

Host execution is action-mediated. Commands outside preapprovals require interactive approval and are denied in unattended contexts. Approval resolution is dashboard/API/user-owned, not model-callable. Hardline destructive commands cannot be preapproved.

Flue run inspection

Raw Flue runs may include prompts, inputs, outputs, and tool data. Keep inspection local and guarded. UI summaries should stay compact and avoid leaking secrets.

Local API access

The local server protects mutating API access behind local-origin checks. Do not expose the local app directly to an untrusted network without adding an explicit auth layer.