Security

This is a local desktop app with no account and no multi-user surface, and it stores nothing of yours on anyone else's machine. Remote access is the one thing that puts a third party anywhere near your work — the app holds a link to a rendezvous relay from launch, so a paired phone has something to attach to — and it is built so that having that link open is not a decision about trusting the relay. What is left is worth being precise about.

• Defended: a hostile web page loaded in the embedded browser tab; a process on your machine poking at the local hook endpoint; a secret leaking out through a support bundle or the app log; the app being talked into reading or deleting something outside the folder it was pointed at; the relay that carries a remote session, which is treated as hostile and cannot read a byte of what passes through it — every payload is sealed under keys established between the desktop and one paired phone, from material the relay never sees.
• Not defended, by design: the agents themselves. Terminal Deck runs them with your permissions and does not confine, filter or review what they do — see below.
• Out of scope: an attacker who is already running code as your user account. At that point they can read the same config files and trigger the same keychain prompts the app can, and nothing in a userland app changes that.

On the Mac each tab is its own WebKit view, so the page runs in WebKit’s own web-content process rather than inside the app. Each browser profile keeps its own data store; an isolated tab keeps its data in memory only.

Addresses

A tab loads http: and https: pages, plus about:, data: and blob: content. file: and javascript: are refused. Other links, such as mailto:, are handed to macOS, and only when you click them.

Permissions

The app holds no camera or location permission, so it has none to give a page.

Downloads

Allowed, through the app’s own download manager, into a folder you choose.

Pop-ups

Opened only from a click. A pop-up becomes a tab of its own that shares the opener’s data, so sign-in windows keep working.

Agents

An agent drives a page only through the app’s own browser tools — open, read, step, screenshot, network, hand back to you.

Isolated tabs

An isolated tab shares no cookies with other tabs, writes nothing to disk, and its data is gone when the tab closes.

On Windows

The browser is WebView2. Isolated tabs are InPrivate, pop-ups become tabs for http and https only, and developer tools are available from the browser’s own menu.

Six decimal digits is 10⁶ — a million codes. The format it replaced was eight Crockford base32 characters, which was 32⁸, about 1.1 trillion. That is a reduction by a factor of roughly 1,099,511, and no wording makes it smaller. It is acceptable because of what a guess has to survive, and each of the following is pinned by a test that fails if somebody removes it:

• The code lives sixty seconds, and is dead at the boundary.
• It is single-use, and is burned the instant it matches — before the device name is checked and before anything is written to disk.
• Five wrong answers kill the code, not the guesser. The counter is against the one code on screen, so an attacker who dials from a fresh address or mints a fresh key for every attempt does not get a fresh budget. That counter is what carries this format.

Five guesses against 10⁶ is 5 × 10⁻⁶ — one in two hundred thousand, per pairing window. The old format was 4.5 × 10⁻¹². The number is written here rather than buried, because one in two hundred thousand is a figure somebody should be allowed to disagree with.

The code has never been the gate. What redeeming one buys is a pending device — a row in a list on the other machine that a human has to approve before it can attach to anything. It is the first of two doors, and it is the half that is only worth as much as the sixty seconds and the five tries.

A typed code cannot carry an address, so it names a rendezvous slot at the relay rather than the machine itself. That lookup would be a free oracle if it were cheap — an attacker who could enumerate slots would sweep the million, find the live one and learn the code exactly — so the slot is derived through memory-hard scrypt. The responder's key pair for that offer is derived from the code as well, so a hostile relay cannot answer in the machine's place.

There is no QR code and no pairing link. Both were removed rather than hidden: the QR did not work, and the link was a two-hundred-character string carrying a live bearer secret that had to travel through a messaging app to be useful — which is a pairing token somebody else's server then holds a copy of. Every route into a credential write that they used is gone, along with the camera permissions the scanners needed.

Nothing is stored that could become a device. Paired devices are recorded as scrypt hashes and public keys only, so a stolen credential file cannot be replayed into a pairing. The one new secret on disk is this machine's own static private key, written 0600.

The agents are not sandboxed. A session you start on your own machine is the real CLI running with your account's permissions and your login shell's PATH. Terminal Deck does not confine it to the project folder, does not review its tool calls, does not filter its file writes and does not add a confirmation step. Whatever an agent can do in your terminal, it can do here — including in a session you are not currently looking at. The exception is a session started from someone else’s paired device: on the Mac it runs in a macOS sandbox limited to the folders you granted that device, with a home folder and agent accounts of its own.

That is the honest shape of the product rather than a gap to be closed in a patch. The app's job is to show you what your agents are doing, not to stand between them and your disk. Run them on projects under version control, and grant permissions the way you would at a bare prompt.

Also true today: the macOS app is signed with an Apple Developer ID certificate but not notarised, so Gatekeeper objects the first time you open it, and the Windows package is signed with the project’s own certificate, which you have to trust once before Windows installs it. Both apps show a new release in a card just above Settings. The Mac installs it only when you say so; the Windows app installs it when you click, or by itself once nobody has used the PC for ten minutes and no AI is working. Either way the app checks the release’s signature and the file before it replaces anything.