Security

Last updated: 4 August 2026

Coderex runs terminals on your own computer and lets you reach them from a browser somewhere else. Most of what needs protecting therefore never leaves your machine. This page explains how the parts that do travel are built, how to report a vulnerability, and what we promise researchers who find one.

Reporting a vulnerability

Email security@coderex.com. Please include what an attacker could achieve, which component is affected, and enough detail to reproduce it. Redact any real credentials or personal data from your evidence.

We aim to acknowledge a complete report within two business days, tell you whether we consider it a vulnerability, and keep you updated until it is closed. We will credit you when we ship the fix if you would like us to. We do not currently run a paid bug bounty, and we would rather say so plainly than imply one.

Safe harbour

If you research in good faith under the rules below, we will not pursue legal action against you, and we will say so if a third party asks. Stay within your own account and devices, stop as soon as you have proof, and give us reasonable time to fix an issue before publishing it.

• Test only accounts, devices and tunnels you control. Do not access anyone else's data.
• If you encounter someone else's data, stop, do not save it, and tell us immediately.
• No denial of service, load testing, spam, or physical or social engineering attacks on us, our providers, or our users.
• Do not use automated scanners against our relay or backend.

Out of scope

Some behaviour looks alarming and is exactly what the product is for:

• Port tunnels are public by design. Opening one makes a service on your machine reachable by anyone with the link, until you close it. That a tunnel is reachable is not a vulnerability.
• Agents run real commands. Coderex launches coding agents that can read files and execute programs on your machine, under your own accounts and API keys. Their behaviour, and the behaviour of anything you ask them to run, is not a Coderex vulnerability.
• Third party services. Report issues in Cloudflare, Convex, Stripe, GitHub, Google or the agent providers to them. Tell us too if it affects Coderex users.
• Findings from automated scanners with no demonstrated impact, missing hardening headers on static pages, and social engineering of our staff.

How Coderex is built

• Your code stays on your computer. Files, repositories, commands and terminal output are not sent to us.
• Remote sessions are end to end encrypted between your computer and your browser, and pinned to a device key you approve the first time you pair. Pairing is confirmed by a six digit code you compare on both screens.
• Our relay is a blind pipe. It forwards sealed frames and holds no key that opens them, so we cannot read your terminals even if compelled to try.
• Credentials are stored hashed. Pairing codes and access tokens are kept only as irreversible hashes, and pairing codes expire in minutes.
• Releases are signed. macOS builds are signed and notarized by Apple, and the app verifies a signature over the update metadata, along with the download's checksum, before it will install anything.
• You can revoke a device from your account at any time, which ends its access immediately.

What we need from you

• Keep Coderex updated. Fixes reach you through the updater.
• Pair only devices you control, check the six digit code, and revoke anything you do not recognise.
• Close a tunnel when you are done, and do not tunnel a service holding data you would not hand to whoever obtains the link.
• Read what an agent proposes before you let it run, particularly when it can modify files or execute commands.
• If you believe your account is compromised, revoke your devices and write to us.

Changes

We update this page as the product changes. See also our Privacy Policy for what we store, and our Terms for the rules that govern use of the service.