Security model
Togo runs no server that sees your work. Terminals travel over SSH or Mosh between your phone and your machine. The relay carries sealed notifications, sealed answers and the plain status fields of Live Activity updates. Your agents still send your prompts and code to their model providers, as they do at your desk. For the full statement, read the security page.
Someone who controls the relay#
They can see that a push or an answer happened, its size and its timing, your device tokens, the host id and the sender's IP address. They can read the plain fields of a Live Activity update: the session number, the agent's name, its state, how many requests are waiting, when it started, the waiting request's id and, for an ended session, one word for why. When a Live Activity update stands in for a notification, the relay adds the alert text, fixed wording chosen from that status. The session's title, its current step, the request and the command are sealed like a notification.
They cannot read an approval, a command or any terminal output, because each notification is sealed to your device's key with X25519, HKDF-SHA256 and ChaCha20-Poly1305. They cannot forge an answer, because the helper accepts only answers signed by a paired device's Ed25519 approval key. They can drop or delay messages, so an approval arrives late or not at all. If they replay an old answer, the helper refuses it: it accepts each request id once and rejects answers older than ten minutes.
Someone on the network#
Terminals run over SSH or Mosh and have those protocols' protection. The app pins each host key on first use and stops the connection if the key later changes. The helper opens no listening port. It talks over stdio inside the SSH session, takes hook reports on a local unix socket, and connects out to the relay.
Someone with your locked phone#
They can read notifications on the Lock Screen if your iOS previews allow it, and deny a waiting request. They cannot approve unless you turned on Approve without unlocking, and they cannot open a terminal or use your SSH key.
Someone with your unlocked phone#
They can use what the phone can use: connect to your machines and answer approvals. Each use of the SSH key needs Face ID, Touch ID or the passcode. Revoke the phone on each machine with togo devices revoke <deviceId> (togo devices ls shows the id). It also tries to remove the phone's key from authorized_keys and tells you if it did not. See Pair your phone.
Someone with your machine#
The machine keeps its keys and the paired device list in your Togo home, readable only by your user. An attacker running as you can read them and answer approvals. Togo does not defend against an attacker who already runs as you.
What Togo does not protect#
- An agent you approve can do what you approved.
- A prompt the helper misses never reaches the phone. It is still live at the desk.
- The relay can see metadata about when you use Togo, such as when pushes are sent and their sizes, and Live Activity status fields.
- Your agents send prompts and code to their model providers. Togo does not change what they send.
To report a vulnerability, use the private report on the repository's Security tab. See Reporting a vulnerability.