Security

There is no server in the middle

PRCHD has no backend. There is no account system, no relay, and no service that receives your code. Your phone opens a direct connection to your Mac over your own Tailscale network, and every view you see on the phone is a projection of state that lives on that machine.

This is a structural property, not a policy we promise to honour. There is no code path that uploads a repository, because there is nowhere for it to go.

The tailnet is the boundary

Tailscale builds an encrypted WireGuard network between devices you own. PRCHD's phone-facing listener binds to that tailnet interface, and never to 0.0.0.0. That is enforced in the host's networking layer rather than left to configuration: there is no setting that exposes the API publicly, and no port to forward.

The dev servers you start from your phone follow the same rule. When you open a running app, you are reaching it at a tailnet address — it is not tunnelled through a third-party preview service and it is not reachable from the public internet.

Pairing and device tokens

Pairing is the one unauthenticated operation, and it exists only to bootstrap trust. The QR code carries a one-time token, the host's tailnet address, and the host's public key. Your phone generates its own keypair, and the exchange issues a device token that is stored in your device's keychain.

Every call after that carries a signed device token, on top of the tailnet boundary. Two independent things must hold for a request to be served: it arrived over your private network, and it presented a token issued to a device you paired.

Revoking a device

Each paired device is listed on the host and can be detached, which revokes its token immediately. If you lose a phone, this is the control that matters — revoke it on the Mac, and that device can no longer reach anything. Re-pairing later re-establishes credentials from scratch.

What the terminal capability means

We would rather state this plainly than bury it. PRCHD lets you run arbitrary commands on your development machine from your phone. That is the point of the feature — it is how you run tests, start servers, and investigate problems without a desk — but it means a paired device is a device that can execute code on your Mac.

The mitigations are the ones above: the tailnet boundary, paired-device authentication, and easy revocation. If you use the biometric app lock, a lost phone also requires your face or fingerprint before the app opens at all. Treat pairing a device the way you would treat adding an SSH key.

What the agent is allowed to do

Each chat runs in one of two modes, chosen by you before the turn starts:

• Plan — reads, researches, and proposes. Changes nothing on disk.
• Work — edits, runs, installs, and commits on its own, with no prompts to answer.

This is a sandbox dial set ahead of time, not a stream of per-action approvals. Work happens inside that workspace's own git worktree and branch, so a session that goes wrong is contained to a branch you can discard.

What leaves your machines

One thing: crash and diagnostic reports, via Sentry. Those contain stack traces and app performance data along with an anonymous installation identifier. They never contain your source code, your messages to the agent, file contents, diffs, or repository names.

Everything else — every message, every diff, every command and its output — travels only between your phone and your Mac. See the privacy policy for the full disclosure.

The Mac app is signed and notarized

The host is distributed as a notarized DMG signed with an Apple Developer ID, which is why macOS opens it without warnings. It is not on the Mac App Store deliberately: App Sandbox would block the app from doing its job — spawning agent CLIs, opening PTYs, and running your project's commands across arbitrary repositories.

Updates are signed with a separate key and verified before they are applied.

Reporting a problem

If you find a security issue, email hello@prchd.app with the details and we will get back to you. Please do not open a public issue for anything exploitable.