**Yes—there are meaningful security and privacy risks.** I would treat T3 Code as a privileged agent and remote-access tool. The reviewed code contains real authentication protections, but it does not justify calling the tool risk-free or its cloud connection end-to-end encrypted.

I inspected security-relevant source files at commit `d13fc846700e5bb7d63e1bfaabb1e55733912b21`. This was a static, partial source review; I did not install it, test exploits, or verify published binaries against the commit.

**The main findings:**

1. **A compromised authorized client can have substantial control over your machine.**  
   The WebSocket server authenticates connections and applies RPC permission scopes, including filesystem, terminal, provider-management, and agent-operation permissions. Those are meaningful safeguards. However, the repository explicitly recognizes that terminal access is a shell as your user, and agent-operation access can launch a full-access agent. Treat a standard paired device as a highly trusted device. [RPC enforcement](https://github.com/pingdotgg/t3code/blob/d13fc846700e5bb7d63e1bfaabb1e55733912b21/apps/server/src/ws.ts#L3091), [permission mapping](https://github.com/pingdotgg/t3code/blob/d13fc846700e5bb7d63e1bfaabb1e55733912b21/apps/server/src/auth/RpcAuthorization.ts), [documented authority boundary](https://github.com/pingdotgg/t3code/blob/d13fc846700e5bb7d63e1bfaabb1e55733912b21/docs/internals/environment-auth.md)

2. **Encryption depends on the connection route.**
   
   | Route | What I could establish |
   |---|---|
   | Direct LAN HTTP | Plain HTTP is supported. It provides no transport confidentiality for credentials or application traffic. |
   | HTTPS endpoint | Protection depends on TLS and whoever terminates it. |
   | T3 Connect | Cloudflare tunnel configuration forwards requests to a loopback HTTP origin; the reviewed RPC path uses JSON without an additional payload-encryption layer. |

   **I could not verify application-level end-to-end encryption that excludes Cloudflare from the trust boundary.** The configuration is consistent with Cloudflare terminating public HTTPS, so you should assume that infrastructure can access application traffic. I could not verify production TLS versions, tunnel cryptographic settings, or logging from this repository. [Direct connection options](https://github.com/pingdotgg/t3code/blob/d13fc846700e5bb7d63e1bfaabb1e55733912b21/docs/user/remote-access.md), [tunnel origin and ingress configuration](https://github.com/pingdotgg/t3code/blob/d13fc846700e5bb7d63e1bfaabb1e55733912b21/infra/relay/src/environments/ManagedEndpointProvider.ts#L341)

3. **Authentication uses cryptography, but signatures do not encrypt your data.**  
   Session tokens contain Base64URL-encoded claims authenticated with HMAC-SHA256 and a random 32-byte server signing key. Verification checks expiration and revocation. DPoP adds P-256/ES256 proofs tied to the request and token, with replay detection. These help prevent forgery and credential reuse; they do not conceal prompts, files, or terminal output. [Session implementation](https://github.com/pingdotgg/t3code/blob/d13fc846700e5bb7d63e1bfaabb1e55733912b21/apps/server/src/auth/SessionStore.ts), [HMAC implementation](https://github.com/pingdotgg/t3code/blob/d13fc846700e5bb7d63e1bfaabb1e55733912b21/apps/server/src/auth/utils.ts#L78), [DPoP verification](https://github.com/pingdotgg/t3code/blob/d13fc846700e5bb7d63e1bfaabb1e55733912b21/packages/shared/src/dpop.ts), [replay protection](https://github.com/pingdotgg/t3code/blob/d13fc846700e5bb7d63e1bfaabb1e55733912b21/apps/server/src/auth/dpop.ts)

   T3 Connect also trusts its relay’s signing authority: a valid relay proof can request a short-lived, client-key-bound bootstrap credential with standard client scopes. A compromised relay signing authority remains consequential. [Credential minting](https://github.com/pingdotgg/t3code/blob/d13fc846700e5bb7d63e1bfaabb1e55733912b21/apps/server/src/cloud/CloudLink.ts#L1495)

4. **The inspected local secret store is not encrypted at rest.**  
   `ServerSecretStore` writes raw bytes to `.bin` files, restricting directories to `0700` and files to `0600`. These permissions help against other OS users, but not malicious software running as you or readable backups. The inspected database layer uses ordinary Node SQLite without a database-encryption key. This finding concerns these storage paths; I did not verify every provider’s credential store. [Secret storage](https://github.com/pingdotgg/t3code/blob/d13fc846700e5bb7d63e1bfaabb1e55733912b21/apps/server/src/auth/ServerSecretStore.ts#L141), [SQLite configuration](https://github.com/pingdotgg/t3code/blob/d13fc846700e5bb7d63e1bfaabb1e55733912b21/apps/server/src/persistence/Sqlite.ts)

5. **Telemetry leaves the machine by default.**  
   Analytics defaults to enabled and sends HTTPS batches to `ingest.t3.codes`; the source says the ingest service retains a copy and forwards events to PostHog. Payloads include installation identifiers, platform/version information, and event properties. Identity code derives hashed identifiers from Codex, Claude, and connected accounts—so this is potentially correlatable telemetry. I did not establish that every event excludes sensitive content. The server supports `T3CODE_TELEMETRY_ENABLED=false`. [Telemetry defaults and transmission](https://github.com/pingdotgg/t3code/blob/d13fc846700e5bb7d63e1bfaabb1e55733912b21/apps/server/src/telemetry/AnalyticsService.ts), [identity derivation](https://github.com/pingdotgg/t3code/blob/d13fc846700e5bb7d63e1bfaabb1e55733912b21/apps/server/src/telemetry/Identify.ts#L250)

6. **Installing “latest” does not install the source you asked me to review.**  
   The README recommends executing a live downloaded installer or `npx t3@latest`. The runtime downloader checks SHA-256 against a checksum file fetched from the same release location. That detects mismatches, but does not independently protect against a compromised release publisher. I did not verify the live installers, release signatures, dependency supply chain, or binary reproducibility. [Installation commands](https://github.com/pingdotgg/t3code/blob/d13fc846700e5bb7d63e1bfaabb1e55733912b21/README.md#L19), [runtime verification](https://github.com/pingdotgg/t3code/blob/d13fc846700e5bb7d63e1bfaabb1e55733912b21/apps/server/src/cloud/pinnedRuntime.ts#L174)

**My recommendation:** first evaluate it under a separate OS account or disposable environment, keep remote access disabled, disable telemetry if unwanted, and use supervised agent permissions. Avoid plain HTTP across a network. For sensitive repositories, require a review of the exact release and remote-access deployment before granting access.

Fixed but not yet released (awaiting review): Nothing.