Credential handling
Desktop session tokens are stored with the operating system’s credential storage. Server-side sessions are hashed at rest and rotate on refresh.
Trust / Security
Your machine, your keys, your call.
Rewyyn asks for powerful permissions because the agent can operate a real computer. The boundaries around those permissions are part of the product.
Permissioned actions
Agent Desktop actions can require approval per tool and per project. Risky commands can be stopped or approved from the session, including from a paired phone.
Remote links
Phone control links are generated by the running desktop session. Treat them as passwords and close a session when you no longer need remote access.
Open source
The client and agent code are open source. You can inspect the permission model, the server gateway, and the plugin host instead of taking a screenshot’s word for it.
Report a vulnerability
If you believe you have found a security issue, please report it privately. Do not open a public issue with exploit details, credentials, or customer data.
Email security@rewyyn.org with the details. If you cannot use email, use the contact page and ask for a private channel before sharing sensitive information.
What to include
- A short description of the issue and the affected surface.
- Steps to reproduce, including the app version and operating system.
- Whether any data, credentials, or remote sessions were exposed.
- A safe way to contact you.
Our side of the deal
We will acknowledge a complete report, investigate it, and keep you updated on the fix and disclosure timeline. Please give us a reasonable window to release a fix before publishing details.
Scope
This policy covers the Rewyyn desktop app, CLI, website, account and inference service, and the remote-control link flow. Third-party model providers and dependencies should be reported to their own security programs.