Security and private data

JMP is a trusted local coding agent, not a sandbox. File/shell/MCP tools have your Windows account's privileges. Use trusted workspaces and MCP endpoints, or isolate the app in a separate OS account/VM for untrusted projects. Do not run as administrator. Neither router confidence nor context compaction is an approval/security boundary.

Credentials

• Use the desktop key form, not chat, for DeepSeek/Jev API keys. These keys are stored with Windows CredWrite/CredRead (generic credential, LOCAL_MACHINE persistence, current Windows account). No roaming, keyring plugin discovery, plaintext fallback or previous-value shadow copies are used.
• Stored key values are never returned to JavaScript. Password fields start empty and are cleared after a save attempt. No key is put in localStorage, a URL, settings JSON, logs or the executable.
• Vault keys are passed directly to provider clients, not exported into the environment inherited by shell/MCP subprocesses. Legacy source .env/shell keys remain supported and can be inherited; prefer the vault for desktop use.
• Saved app keys take precedence over environment keys. Removing an app key does not remove an environment key or revoke it at the provider; the UI discloses that fallback. Revoke a compromised key at its provider.
• Changes are rejected while a run is active. Previously used keys remain redacted for the rest of that process. Redaction is best-effort, not encryption of session history. Unknown secrets in source/tool output can still be saved.
• Windows protection does not defend against malware or another process running as the same logged-in account. Account backups/OS recovery can retain data; removal is not a forensic secure-erase promise.

ChatGPT subscription sign-in

• The app bundles a pinned official native Codex runtime. No Node, npm, separate Codex installation, or PATH-resolved runtime executable is needed.
• Browser OAuth and token refresh are owned by Codex in JMP's private codex/ state directory, not the API-key form/vault or personal ~/.codex. Treat that entire folder as credentials. Its app-owned config.toml is reset to JMP's restricted settings when starting the runtime.
• Only HTTPS sign-in URLs on auth.openai.com are opened. Tokens and OAuth URLs never cross the webview bridge or session event stream. Sign-in uses the runtime's temporary local OAuth callback server; the app-server RPC transport itself is private stdio, not a network socket.
• Runtime subprocess environments remove secret-like variables and OpenAI/Codex overrides. Subscription mode requires a ChatGPT account and cannot fall back to API-key billing. Existing CLI/API-key credentials are not imported.
• Each generation is an ephemeral, isolated thread. Shell/browser/subagent tools are disabled, approvals/tool requests are rejected, and read-only sandboxing is requested. JMP's own tools still have the privileges described above. These restrictions are not an OS-security guarantee for arbitrary hostile native binaries: the bundled software remains trusted application code.
• No private reasoning or raw runtime diagnostics are forwarded to session logs. Crashed/interrupted turns are never automatically replayed. Sign-out and generation-setting changes are blocked while a JMP run is active.

Desktop boundary

The privileged webview loads only bundled local assets. It cannot be pointed at a remote development URL. Markdown does not execute raw HTML; remote images are not fetched. A restrictive CSP applies; eval is enabled only because pywebview constructs its bridge functions dynamically. Release developer tools are disabled. Artifact viewing accepts only IDs referenced by the selected session and rejects resolved paths outside that session. External links accept only HTTP(S), without embedded credentials/control characters.

The standalone app stores writable state under %LOCALAPPDATA%\JMP, outside the EXE and source tree. It never imports a neighboring .env or mcp.json. Conversations contain private code and should not be uploaded. Stop/close is cooperative; do not assume a force-killed tool had no effects. Review interrupted side effects before acknowledging and continuing.

Network/privacy

Task context goes to Jev and enabled MCP services when a task runs, and to the selected generation provider: OpenAI, DeepSeek, or optional local Bonsai. Neither OpenAI nor Bonsai replaces Jev routing. Bonsai model/runtime downloads are pinned and SHA-256 verified; its owned model server is authenticated and loopback-only. The bundled Codex native archive is SHA-512 pinned and verified at build time; its executable hash is checked before startup. OpenAI sign-in and usage are subject to the account's service terms and subscription limits. API providers have their own billing/retention/privacy terms. The bundled Microsoft WebView2 Runtime can communicate with Microsoft, including Defender SmartScreen and runtime diagnostics. SmartScreen is enabled; see Microsoft's Privacy Statement and Edge Privacy Whitepaper. The UI and bundled runtime terms disclose this; JMP does not claim that all runtime/OS network traffic is disabled.

Before publication

Run python scripts/public_audit.py --history, inspect the candidate file list, and use scripts/export_public.py instead of zipping the local folder. Ignore rules cannot undo an earlier commit; a leaked credential must be revoked even if removed from history. Enable hosting-provider secret scanning/push protection. Never paste keys, complete private tool traces or credential-vault exports in a public issue. Report security issues privately to the repository owner through GitHub's private vulnerability reporting channel if available. Otherwise request a private contact without posting the vulnerability details or sensitive data.