LEGAL
Security practices
Authenticated Bridge, least privilege and explicit confirmations.
LEGAL
How it works in Torch
Threat model and least privilege
Torch assumes terminals and agents can execute commands with Windows user privileges, so it separates UI, preload and main process and reduces privileged surfaces.
Renderer and main-process isolation
Renderers use sandboxing, context isolation, disabled Node integration and web security. Production fuses block RunAsNode, Node options and CLI inspection.
Authenticated Bridge and path validation
The Bridge requires an authenticated session; IPC validates contracts and paths. File, Git, worktree and environment operations do not receive unrestricted renderer authority.
Destructive-action confirmation
Deletion, restore, worktree and other material actions require native or contextual confirmation. The app does not request elevation or install drivers or services.
Diagnostics, updates and reporting
Diagnostics remove secrets and workspace data; updates require signed artifacts and qualified rollback. Report vulnerabilities privately to security@torchorchestrator.com.