Continuum Terminal

Security

An honest account of the implemented security foundations, trust boundaries and release blockers.

Draft · last updated August 11, 2026

Architecture

The host PTY is authoritative. Client endpoints authenticate, replay-check, decrypt and render ordered protocol messages. The Fastify control plane stores metadata, public key packages and opaque encrypted records, and relays bounded binary frames.

Cryptographic foundation

Ed25519 signing identities and X25519 agreement keys generated at endpoints.
HKDF-SHA-256 key derivation and XChaCha20-Poly1305 authenticated encryption.
Signed/versioned device key packages and recipient-bound session-key grants.
Argon2id password hashing, short-lived JWT access tokens and rotating opaque refresh families.

Browser account limitation

Browser WebCrypto support for non-exportable, interoperable Ed25519/X25519 identity is not portable enough for this app contract. Web signup therefore performs only a local deep-link handoff. It does not call /v1/auth/register, collect a password, generate weaker keys or store bearer tokens. Native registration supplies email, password, device metadata and the required public key package.

Known limitations

Not production-approved: required full Client→Cloud→Agent remote viewing and input demonstrations do not pass. Inbound remote commands remain deliberately rejected. Complete key rotation/revocation behavior, cross-platform device tests and independent review are still required.

The cloud cannot validate project-specific opaque pairing authorization transcripts. Endpoint integration and external review are mandatory. A compromised authorized endpoint can expose data available to that endpoint. Traffic analysis and operational metadata are not eliminated.

Reporting

Report vulnerabilities privately to security@geekbug.dev. Include affected version, impact and reproduction steps, but no live credentials, private keys or terminal content. A disclosure SLA and public security policy have not yet been adopted.