Security model
Relay can read your code, run commands and post as you, so it’s built to be safe by default.
Only you can reach it
Section titled “Only you can reach it”- The server listens on
127.0.0.1only and rejects cross-origin requests. - Binding to localhost keeps other computers out, but not other accounts or sandboxed apps on the same machine. So every
/apirequest must carry a token: a random value indata/api-token, readable only by your account. - The browser gets the token as an HttpOnly cookie from a one-time link (
/auth?token=…) that Relay prints when it starts. The desktop app sets the cookie itself.
Keys stay put
Section titled “Keys stay put”- Keys live in
data/secrets.jsonand store credentials indata/credentials.json, both readable only by your account. They never reach the browser; the app only sees whether each one is set. - Agent tools you’ve installed keep their own credentials. Relay runs them; it never reads their keys.
Replies are checked before they leave
Section titled “Replies are checked before they leave”Replies are written by a model that has read other people’s messages. Text planted in a Slack thread or ticket could try to get it to read a key file and paste it. So every reply is checked last thing before it’s posted: any of Relay’s own saved secrets, and anything shaped like a common key or token, is replaced.
Other people’s words are data
Section titled “Other people’s words are data”Event text and attachments are framed as data from other people, never as instructions. And the decision about what Relay may do is made by a deterministic router, not the model.
Approvals
Section titled “Approvals”Code changes, pull requests and deletes always wait for approval, and so do ticket changes asked of you through your own connection, since they’d be made in your name. Only the Slack members you list can press Approve in Slack. See Approvals.
Repo files can’t run things on their own
Section titled “Repo files can’t run things on their own”Actions defined in a repo’s arkinsta.yaml run only after you’ve reviewed them on the Actions page, and again after any change to the file. A run that was queued before the file changed won’t start.
Option values reach commands as environment variables, never spliced into the command text. Step folders must stay inside the repo.
Your checkout is safe
Section titled “Your checkout is safe”A code run refuses to start over uncommitted work, works on its own arkinsta/… branch, never commits .env, keys or credentials, and switches back to your branch when done. Git is called with argument lists, never through a shell.