ConductoreComing soon — $49

Security

Conductore is built with security as a first-class concern. This page describes the security architecture and the protections in place.

Electron sandbox

Conductore uses Electron's contextIsolation: true and nodeIntegration: false settings. All Node.js APIs are exposed to the renderer exclusively through a typed contextBridge API (window.api). The renderer process cannot access Node.js or Electron APIs directly.

The renderer runs in a sandboxed environment. Direct access to the filesystem, network, or system APIs from React components is not possible — all such operations go through the IPC bridge.

Content Security Policy

The app enforces a strict CSP via Electron's webRequest.onHeadersReceived:

default-src 'self'
script-src 'self' 'unsafe-inline'
style-src 'self' 'unsafe-inline'
img-src 'self' data: blob:
connect-src 'self' https://conductore.dev
font-src 'self' data:

This prevents XSS by blocking external scripts, data exfiltration by restricting connect-src, and clickjacking by the frame-src 'none' directive.

Credential storage

All sensitive data is encrypted using Electron's safeStorage (OS-level encryption):

  • Git provider PATs — stored in a dedicated electron-store named git-provider-tokens
  • Database passwords — stored per connection with safeStorage encryption
  • Remote access password — stored encrypted in the app config
  • License key — stored encrypted in a dedicated store

safeStorage uses the OS keychain (macOS Keychain, Windows DPAPI, Linux libsecret) so credentials are only readable by the Conductore process on your machine.

SSRF protection

Provider host URLs are validated with new URL() before any network request is made. Only http:// and https:// protocols are allowed. Private IP ranges are not explicitly blocked — use your firewall for that.

File access restrictions

writeFile is restricted to files within a configured root folder. Attempts to write outside the project root are rejected. This prevents path traversal attacks via crafted task file paths.

URL handling

shell.openExternal() only accepts http:// and https:// URLs. Electron devtools and remote debugging (CDP) are disabled in production builds unless explicitly enabled in Settings → Advanced → Enable DevTools.

Network

The remote access server binds to 127.0.0.1 only — it cannot receive connections from the network without the tunnel. All authentication uses timing-safe comparison (timingSafeEqual) to prevent timing attacks.

Update security

Auto-updates are delivered via the electron-updater generic provider. Update files are verified with a SHA512 checksum embedded in latest.yml. Tampered update files are rejected before installation.

Reporting vulnerabilities

Found a security issue? Please email security@conductore.dev with a description. We respond within 48 hours and will credit you in the changelog if you consent.