← Back to the comparison

Independent review · Full response

Herdr

Herdr · Codex · Security code review

2026-10-22a2008661c ↗Public-web access only

Exact prompt

Is there a security risk in installing this tool? Read the security-related code in this repository and understand its encryption and data transmission mechanisms before answering. If a mechanism cannot be verified from the accessible code, say so.
Pinned repository link supplied with the question ↗

The text below is the agent’s complete original response, with its original language identified. The introduction is editorial, not part of the original output or an independently verified conclusion. No installation or attack testing was performed.

Editorial introduction

Confirms SSH transport and OS-protected local sockets. Saved state is readable JSON; no independent publisher-signature check found.

Reading scope: Installer, persistence writer/snapshot, SSH attach, Unix/Windows API controls, update and plugin paths.

Download the complete original English text · SHA-256 1cefd2c2e38306df79d4e3bea8f2101877235acfa6d871711d8e5906cbc80b8f

Complete original response

Yes—there are meaningful security risks, although I found no evidence of intentional data theft in the code paths I inspected. I would treat Herdr as a trusted terminal controller with access to sensitive session content, rather than as an isolated utility.

I reviewed source files pinned to commit a2008661cd4a89ff6df22bf4a6b472bd413018be. This was a static review through accessible GitHub source; this session had no filesystem-reading or shell tool, so I could not inspect the local checkout, run tests, or capture actual network traffic.

The main findings are:

  1. Installation trusts the website and its release manifest.
    The Unix installer downloads https://herdr.dev/latest.json, obtains a binary URL and SHA-256 checksum, verifies the download, and installs it into ~/.local/bin by default. It does not request root privileges. However, the checksum comes from the same manifest that selects the binary: an attacker controlling that manifest could replace both. I found no independent publisher-signature verification in this installer. Also, the documented curl … | sh command executes the live website’s script, which is not pinned to the reviewed commit. Installer source

  2. Saved session data is not encrypted at rest.
    Persistence serializes directly to JSON and writes those bytes to disk. Saved fields include working directories, launch arguments, agent session references, and resume arguments. Optional history contains ANSI terminal content. Consequently, secrets displayed in saved history—or passed through saved arguments—can persist in readable files. The writer does not explicitly apply owner-only file permissions; protection depends on the surrounding directory permissions, OS defaults, and umask. Persistence writer, saved fields

  3. Remote terminal encryption is delegated to SSH.
    Herdr launches the system ssh executable and carries its remote bridge through SSH command input/output. I found no separate application-layer encryption in that transport. Saved/noninteractive connections explicitly use StrictHostKeyChecking=yes; ordinary interactive connections depend more on SSH configuration and normal SSH behavior. I cannot verify the actual cipher, key exchange, private-key protection, or effective host configuration from this repository—those depend on the installed SSH implementation and machine configuration. SSH transport and options

  4. The local API relies on OS access controls, not encrypted or token-authenticated requests.
    The inspected API uses local sockets, with Unix socket permissions set to 0600. Windows uses a user-specific named-pipe security descriptor and, by default, an integrity restriction for elevated servers. The request handler parses JSON without an application login/token handshake. These are useful protections against other accounts, but ordinary processes running as your account remain within the trust boundary. Do not expose or forward this socket to untrusted users. API server, Windows controls

  5. Background network requests exist.
    Update checks fetch hosted manifests; detection updates fetch a catalog from herdr.dev/agent-detection/index.toml. The inspected fetches use curl with HTTPS URLs and no explicit TLS-verification bypass. These requests do not attach terminal content in the examined functions, although the receiving infrastructure can observe connection metadata. Background version checks announce updates and wait for explicit installation. This does not establish that every feature or plugin is free of uploads or telemetry. Updater, detection downloads

My recommendation: reasonable to evaluate under an unprivileged account with non-sensitive projects, but I would not approve it for confidential production work based on this review alone. Use an inspected, pinned installation path; protect its saved state; avoid unnecessary history retention; and treat plugins as executable code—the inspected plugin launcher runs external commands without establishing a sandbox. Plugin command execution

I could not verify that distributed binaries match this source, the live installer matches the committed installer, server-side retention policies, or the security of all dependencies and plugins. No installation was performed.

Fixed but not yet released (awaiting review): Nothing.

← Back to the comparison