Security for Forge

Overview

Forge is designed with security as a foundational principle. This document describes the security measures implemented in Forge to protect your data and systems.

SecureStore Usage

Credential Storage

• SSH passwords, private keys, and passphrases are stored in Expo SecureStore
• AI provider API keys are stored in Expo SecureStore
• SecureStore uses Android Keystore for hardware-backed encryption
• Credentials are marked with WHEN_UNLOCKED_THIS_DEVICE_ONLY accessibility
• This means credentials are:
  • Encrypted using Android Keystore
  • Available only while the device is unlocked
  • Not included in Android backups
  • Tied to the specific device and cannot be extracted

What Is Not Stored in SecureStore

• Connection metadata (host, port, username, workspace paths)
• UI preferences
• Assistant history
• These are stored in AsyncStorage without encryption

Android Keystore

How It Works

• Android Keystore provides hardware-backed key storage
• Keys are generated and stored in the Trusted Execution Environment (TEE)
• Encryption operations happen inside the TEE
• Private keys never leave the secure hardware boundary

Benefits

• Resistant to extraction attacks
• Protected against root access
• Tied to device lock screen authentication
• Cannot be backed up or transferred

AES-256-GCM Encryption

Assistant History Encryption

• Assistant messages and tool results are encrypted before storage
• Uses AES-256-GCM (Galois/Counter Mode)
• Encryption key is stored separately in SecureStore
• Provides both confidentiality and integrity
• Prevents tampering with encrypted history

Implementation Details

• Each message is encrypted with a unique nonce
• Authentication tag ensures data integrity
• Encryption key is generated at first use
• Key is never stored in AsyncStorage
• History cannot be decrypted from backup

SSH Host Verification

Trust-on-First-Use (TOFU)

• First connection to an SSH server requires explicit trust
• Server host key fingerprint is shown for verification
• Fingerprint is stored in AsyncStorage for future connections
• SHA-256 is used for all fingerprint hashing

Changed Host Key Detection

• If a server's host key changes, future connections are blocked
• HostKeyMismatchError is thrown
• User must explicitly remove trust before reconnecting
• Prevents man-in-the-middle attacks

Fingerprint Display

• Fingerprints are shown in SHA-256 format
• User can verify against known server fingerprints
• No automatic trust of new or changed keys

Explicit AI Approval Workflow

Read-Only Operations

• A narrow allowlist of read-only operations may auto-run
• Examples: file reads, directory listings, git status
• No user approval required for allowlisted operations
• Operations are bounded to prevent resource exhaustion

Mutating Operations

• All mutating commands require explicit user approval
• Medium-risk commands receive stronger warnings
• High-risk commands require exact retyping
• Critical destructive patterns are blocked by default

Approval Controls

• Approvals are not persisted across app restarts
• Interrupted approvals do not silently resume
• You must re-approve actions after process death
• No background or scheduled operations

Local-Only Storage

No Cloud Storage

• All data remains on your device
• No Forge-operated servers
• No centralized data collection
• No analytics or telemetry

Data Locations

• SecureStore: Encrypted credentials (Android Keystore)
• AsyncStorage: Non-secret metadata and encrypted history
• No external storage access
• No cloud backup of any data

Data Deletion

• Clearing app data removes all stored information
• Uninstalling the app removes all data
• No residual data on external services

No Telemetry

What We Don't Collect

• No usage analytics
• No crash reports
• No performance metrics
• No device identifiers
• No advertising identifiers
• No location data
• No contact lists

What This Means

• Your usage patterns are private
• No data is sent to third-party analytics services
• No tracking across sessions
• No data collection for marketing

Network Security

SSH Connections

• All SSH traffic is encrypted
• Uses SSH protocol for authentication and transport
• Host-key verification prevents man-in-the-middle attacks
• No plaintext credential transmission

AI Provider Connections

• Cloud providers use HTTPS/TLS
• API keys sent only in authentication headers
• No API key reuse across providers
• Local Ollama uses HTTP (explicitly opted-in)

File Transfers

• SFTP uses SSH encryption
• Android document picker for file selection
• No broad storage permissions
• Files not retained after transfer

Security Limitations

What Forge Is Not

• Not a shell sandbox
• Not a secret manager
• Not a guarantee that approved commands are safe
• Not a substitute for server-side security controls

What You Should Do

• Review all AI suggestions before approval
• Use SSH accounts with least privilege
• Keep your SSH servers updated
• Verify host fingerprints on first connection
• Use strong SSH key passphrases
• Regularly review and remove unused connections

Reporting Security Issues

If you discover a security vulnerability in Forge:

• Report to the maintainers through GitHub
• Do not publicly disclose until patched
• We will respond within 72 hours
• Credit will be given for responsible disclosure

Security Updates

• Security updates are released as app updates
• Critical vulnerabilities are patched immediately
• Users should update promptly
• No automatic update mechanism

Note: This security document describes Forge's implementation as of v1.0.0-rc.1. Security measures may evolve in future versions. Always review current documentation and verify security properties against the signed production artifact.