Security

Last updated: 8 October 2026 · Deutsch

You are asked to hand a closed-source app an OAuth sign-in and, for cost figures, an admin API key. That is a fair thing to hesitate over. This page is the record you would otherwise only see after installing: what was examined, what was found, what was fixed — and what was deliberately left alone.

Most people never enter a key at all

The fair question about a free app with closed source is what it wants from you in return. So, first things first: for the two subscriptions most people come here for — Claude and ChatGPT — you simply sign in. That runs over OAuth, on the providers' own sign-in pages, and the app never sees a password. No admin key is created, and nothing gets pasted anywhere.

Every API card is optional and stays empty until you decide otherwise. Install it, sign in, done — for most people the admin-key question never comes up at all. It only starts to matter if you also want to see what the APIs cost you, and that is what the rest of this page is about.

Why trust an app you can't read?

Free, open-source tools exist, and their strongest argument is genuine: you can read what a program does before you hand it an admin key. This app can't offer that. It pays in a different currency — convenience and platform safeguards, not verifiability. The sandbox is enforced by macOS, not promised in a README; it arrives signed and notarized in one click; and security fixes reach everyone through automatic updates, not only the people who watch a release page. That holds for the App Store editions on Mac, iPhone and Watch — the Windows build is in no store, so there is no sandbox, no signature and no automatic update there.

✓ And the actual answer to the trust question: the security record.

Closed code doesn't have to mean «just trust me». The security record documents four review passes with their concrete findings — what was examined, what turned up, what was fixed, and what was left undone on purpose. It doesn't replace reading the source; it is the most honest thing a closed codebase can put on the table.

And if you would rather judge the work than the claims about it: I write the awkward defects up in the notes — what broke, what actually caused it, and what I did about it.

What this review is, and what it is not

It is a documented, model-assisted framework review carried out with Claude Fable 5 across four dates, each producing a written report. It is not an external audit. No independent firm was commissioned, and nobody outside this project has read the source. If that is your bar, this app does not clear it, and no wording here will change that.

What the review does give you is a specific, checkable account rather than a badge. Every finding below names the class of defect and what was done about it.

Which version was reviewed

The last full pass ran on 10 August 2026 against the code that shipped as version 5.0. The current release is 6.5.

Added since, and therefore not covered by a formal pass: the OpenRouter and Grok cards, the second Claude account, demo mode, the setup assistant, the drag-to-reorder cards, the monthly-total line, the rating prompt, GitHub Copilot, the live ChatGPT fetch, the outage indicator and the tip jar (6.5). The hardening the passes produced — no redirects, Keychain-only credentials, capped parsing of foreign transcripts — applies to all of it, because it sits in the shared layers. But the honest statement is that 6.5 has not been through its own review, and saying otherwise would defeat the point of this page.

Validated against

OWASP ASVS 4.0 · OWASP MASVS
Apple Secure Coding Guide
RFC 8252 (OAuth for native apps) · RFC 7636 (PKCE)
CWE Top 25

The passes

Pass 2.1 — five findings, all fixed

2 August 2026 · two independent runs

Command injection through the Codex path (CWE-78) — AppleScript dropped, the path is now shell-escaped into a .command file.
HTML injection in the OAuth callback page — output is escaped.
Data race on startup in the Codex connector — access moved onto the queue.
Ignored return value of SecRandomCopyBytes — it now throws instead of silently producing weak randomness.
Path traversal via an agentId taken from a foreign transcript — characters are filtered.

Pass 3.1 — no critical or high finding, nine items fixed

4 August 2026 · two independent runs · 103 tests green

The five findings from 2.1 were verified as still closed.

Integer trap from foreign transcripts (CWE-190). A single line containing "input_tokens": 1e300 crashed the app on conversion — and again on every restart, because the file stayed in the activity window. Values are now capped and sums saturate.
«Open project folder» launched whatever the path named (CWE-73). The path comes from the cwd field of a foreign transcript; if it pointed at an application bundle, the click started a program. It now only reveals in Finder, and only for a real folder.
Redirects carrying the admin key (CWE-522). Every client uses a session that does not follow HTTP redirects, so a 301 cannot walk a key over to another host.
Race on sign-out (CWE-613). A token refresh in flight used to write the deleted tokens back into the Keychain. It now discards its result.
Check-then-set race starting the Codex service (CWE-362) — two callers could spawn two child processes and orphan one. Now atomic.
Missing resource limits (CWE-400): 4 MB per read pass, 200 subagent files per session, a 4 MB buffer on the Codex connection, 25 OpenAI projects, and Codex logs are read from the file end only.
Symbolic links (CWE-59) — the history file is opened with O_NOFOLLOW.
Honest timestamps — Codex log values carry the log's own time, not the time of the query; Kimi's balance and coding quota have separate states so one cannot pass the other off as fresh.
Less disclosure — the key preview shows only the last four characters (the self-test is meant to be sent to someone), and Keychain entries are set to this-device-only.

Pass 4.1 — display layer

9 August 2026 · two runs: bugs and improvements, then the security of the display layer

Both reports were worked in before the release. This pass produced no separate security finding list, and it would be padding to present one here.

Pass 4.2 — no critical finding; two important and three minor fixed

10 August 2026 · shipped as version 5.0

UTC day boundary in the credit calculation. The cost API's buckets start at UTC midnight, but the cut-off date was built with the local calendar — west of UTC the top-up day fell out of the sum and the app showed too much credit. It now computes in UTC, with a test across eight time zones.
Unbounded Int(…) on the remaining time in the menu bar icon: an outsized resets_at from the server could crash the app. Capped at eight days.
Minor: Decimal(Double) distorts amounts, so the top-up amount travels as a string; a stale subtotal could be shown against a new amount; an unnecessarily public interface was closed.

The findings from 2.1 through 4.1 were verified as still closed.

Deliberately not done

These are judgement calls, not oversights. They are listed because a review you cannot disagree with is worth nothing.

No browser cookies, anywhere. The app reads no cookies from any browser, and its own connections neither send nor store any: on the Mac httpShouldSetCookies = false and httpCookieAcceptPolicy = .never, on Windows UseCookies = false. Malware that steals browser session cookies is a real threat; an app that collected them would be one more place to steal them from. The price: figures only reachable through a browser session — the Claude credit balance, for one — stay off the cards.
No browser session key for the OpenAI credit balance. Reading the remaining credit would have been easy with a sess-… cookie — and that cookie is full access to your OpenAI account. The balance is instead derived from the top-up amount you enter yourself minus the daily costs the app already fetches. No extra request, no new secret.
Sandbox — none in the reviewed state. The reviewed 5.0 ran without the App Sandbox because it had to read ~/.claude and ~/.codex freely. Since 5.1 the Mac App Store edition runs sandboxed and asks for exactly those two folders as an explicit grant — access stays read-only and comes from you.
The OAuth callback stays on http://localhost:<port>/callback. RFC 8252 §7.3 recommends the literal 127.0.0.1, but Anthropic's client accepts exactly this form — switching would break sign-in. The rebinding risk is contained because the server listens on the loopback interface only (requiredInterfaceType = .loopback).

What the Mac app connects to

This is the full list — the same one the app shows on its About page. Redirects are not followed, and the contents of your sessions are never transmitted.

Address	What for	Needs
`claude.com`, `platform.claude.com`	Signing in and out of Claude	Your Claude subscription
`api.anthropic.com`	Subscription usage windows, and separately the cost of the API	Sign-in, or an admin key
`auth.openai.com`	Signing in to your ChatGPT account — the page belongs to OpenAI	During sign-in only (App Store edition)
`chatgpt.com`	Quotas and credits of the signed-in ChatGPT account	ChatGPT sign-in
`api.openai.com`	OpenAI API cost and token usage	Admin key, optional
`api.moonshot.ai` / `api.moonshot.cn`, `api.kimi.com`	Kimi balance and coding quota	API key, optional
`openrouter.ai`	Credits, spend and the limit on your key	An ordinary key, optional
`management-api.x.ai`	xAI balance and spending cap	Management key, optional
`api.github.com`	The login name for your token, and the GitHub Copilot billing report	GitHub token, optional
`api.deepseek.com`	DeepSeek balance per currency — from version 7.2	API key, optional
`status.claude.com`, `status.openai.com`, `status.moonshot.cn`, `www.githubstatus.com`	The providers' public incident reports — nothing is sent, only a public status file comes back. GitHub for the Copilot card, from version 7.2	Only while that provider's card is set up
`localhost:<port>/callback`	The OAuth return trip, loopback interface only	—
Local files: `~/.claude`, `~/.codex`	Your Claude Code sessions and the ChatGPT subscription limits, read on your Mac. Nothing of it leaves the device.	Read-only access you grant once

There is no server of mine anywhere in that list. ChatGPT limits on the Mac come either from your local Codex install or, if you sign in to ChatGPT inside the app, straight from chatgpt.com.

The iPhone app contacts the same services, DeepSeek included from 2.11 and www.githubstatus.com from 2.13; its own table is in its privacy policy. The Windows edition contacts the same services too, and from 1.5 one more thing: once a day it asks api.github.com whether a newer version is out — without credentials, with nothing but the IP address and the identifier “AI-Cockpit”. That check can be switched off under Settings › About. From 1.6 it also reads www.githubstatus.com for the Copilot card, and keeps all its data in %APPDATA%\AI-Cockpit (up to 1.5: %APPDATA%\AI Dock).

Don't take my word for it. Watch the wires.

The security record names every host the app ever connects to, line by line, and says what each one is for. That list is not a reassurance — it is a claim I can be caught on.

So catch me on it. Put a network monitor in front of the app — Little Snitch, LuLu, whatever you already trust — and let it run for a day of ordinary work. Everything it records should already be on that list. If anything isn't, it belongs in public, and I would much rather read about it than not: the feedback form comes straight to me.

Why an admin key, and what it can do

OpenAI and Anthropic expose cost and usage figures through their admin endpoints alone — a normal project key returns nothing there. That is a real concession on your part, so the two things worth knowing:

The cockpit only ever reads. It creates nothing, changes nothing and deletes nothing in your account.
The key lives in the macOS Keychain, this-device-only, and travels only to the host it belongs to — never through a redirect. Settings → «Reset everything» removes it locally; it stays valid at the provider until you revoke it there.

If that trade is not one you want to make, leave those two cards off. Every card is optional, and the rest of the cockpit works without them.

Reporting a vulnerability

Use the contact form and say up front that it is a security report — leave an address you can be reached at and you will get a reply there, so the details need not go into the form itself. Please give it a few days before publishing — this is one person, not a security team.