Security

Credentials

• Provider keys use macOS Keychain.
• Desktop account tokens use the native desktop credential flow and are forwarded only for authenticated OpenSS account requests.
• Backend logs redact authorisation, cookies, tokens and secrets.
• Do not place signing, Stripe or provider secrets in documentation or issue reports.

Local server

The CLI browser GUI binds to loopback and exchanges a one-time launch token. The desktop engine is also localhost-only and checks the desktop origin/session. Do not expose either service to a network.

Report safely

Include the OpenSS surface, version, macOS version, safe error code and steps to reproduce. Remove screenshots containing private content and never paste Keychain values, account bearer tokens or provider keys.