Security & Storage | Ghostable Desktop | Ghostable Menu Security & Storage Security boundary ----------------- Ghostable Desktop is a local interface to the CLI engine. Project values are encrypted before repository storage and decrypted only on a device with the required identity and environment access. Ghostable does not operate a hosted service that receives those plaintext project secrets. That statement does not make every local workflow zero-risk. The operating system, clipboard, editor, generated files, terminal processes, CI runners, deployment providers, backups, and anyone controlling an authorized device remain separate trust boundaries. Read the [CLI Security reference](https://ghostable.dev/docs/3.x/reference/security) for cryptographic primitives, threat-model scope, audit status, and repository-level recovery constraints. Repository state ---------------- The `.ghostable/` directory contains the project manifest, encrypted environment values, public device records, wrapped environment keys, signed policy and activity, validation schema, and other engine state. It is designed to be committed and reviewed. Encrypted does not mean disposable. Back up repository history and preserve at least one authorized owner identity. Encrypted values cannot be recovered from Git alone when every valid private identity and usable key envelope is lost. Private identities ------------------ Project device private keys are stored outside the repository using the CLI's platform identity store. On macOS this normally uses Keychain; development or explicitly configured environments can use a protected file-backed keystore. A project identity is different from the Desktop activation token. Backing up or releasing one does not manage the other. Desktop-local data ------------------ - Launcher groups, project names, and local repository paths are stored as local application organization state. - General and appearance preferences are stored in the Desktop application data directory. - The protected license activation token is stored in macOS Keychain; signed entitlement metadata and validation status are cached in application data. - Project plaintext is not intentionally copied into launcher metadata or license state. macOS backups may include some application metadata. Apply the same device encryption and backup controls you use for source repositories and developer credentials. Network behavior ---------------- Core project management is local and repository-backed. Desktop makes network requests for license activation and validation, activation release, and update checks or downloads. Links such as purchase, documentation, privacy, or support open the configured Ghostable website in the system browser. Licensing requests do not need project environment values or repository contents. Deployment operations are separate: when you intentionally deploy, the destination provider or process receives the plaintext values necessary to run the application. Plaintext exposure ------------------ - Revealing or editing a value exposes it to the current renderer, display, and operating-system process memory. - Copying a value exposes it to the clipboard and any clipboard-history utility. - Pulling a local file writes plaintext to disk. - Opening a file or repository in an IDE extends trust to that editor and its plugins. - Running or deploying with an environment extends trust to the child process, CI runner, and provider. Use full-disk encryption, a locked screen, trusted editor extensions, ignored local files, minimal project roles, scoped automation credentials, and credential rotation after suspected exposure. Electron hardening ------------------ Desktop project and settings windows run with renderer sandboxing, context isolation, and Node integration disabled. A narrow preload API exposes approved operations, and the main process validates window roles, project scope, command allowlists, and file paths before invoking the CLI. These controls reduce renderer-to-system risk but do not replace operating-system patching, signed updates, dependency review, or careful handling of untrusted repositories. Report a security issue ----------------------- Use the [security report form](https://ghostable.dev/security) or email . Include Desktop and bundled CLI versions, macOS version, impact, and reproduction steps. Redact license keys, project secrets, private identities, and automation tokens. On this page [ ![Ghostable](https://ghostable.dev/images/logo-dark.svg) ![Ghostable](https://ghostable.dev/images/logo-light.svg) ](https://ghostable.dev) Desktop [ CLI 3.x ](https://ghostable.dev/docs/3.x) [ Desktop ](https://ghostable.dev/docs/desktop) CLI 3.x introduction Documentation local first no login encrypted repository plaintext hosted service Installation Documentation brew homebrew npm npx linux windows PATH version update Start a new project Getting Started setup seed dotenv owner initialize Adopt an existing project Getting Started existing env import authoritative source adopt Onboard a team member Getting Started join request approve roles offboarding pull request Repository and storage Core Concepts .ghostable git conflict merge worktree private identity metadata Environments Core Concepts protected production preview staging push sync pull replace run mask-output Variables and promotions Core Concepts var promote copy context annotation key Access and devices Core Concepts identity reader writer grantor owner revoke rotate leave delete Daily development workflow Workflows pull diff validate review clean daily Review and secret scanning Workflows scan sarif github suppress secrets drift Hygiene and rotation Workflows rotation stale unused suppression environment key Automation credentials Automation & CI GHOSTABLE\_CI\_TOKEN ci deploy credential powershell revoke replace Continuous integration Automation & CI GitHub Actions fork pull request JSON stdout stderr exit codes mask-output Deployments Automation & CI Forge Vapor Cloud provider CLI dry-run preserve remote keys temporary files Validation Reference schema required nullable regex min max different\_from Command reference Reference --help --json NO\_COLOR flags aliases exit code automation Configuration Reference ghostable.yaml activity mode auditEnvironments scan ignores deployTarget dotenv syntax Security Reference cryptography XChaCha20 Poly1305 HKDF user presence threat model Backups & Offline Reference recovery offline restore clone key identity Agent integration Reference AGENTS.md capabilities allowlist coding agent Troubleshooting Reference no project found revoked identity stale policy user presence invalid CI token provider CLI git conflict diagnostics Ghostable Desktop overview Desktop Installation Desktop Projects and setup Desktop Interface tour Desktop Environments and variables Desktop Local environment files Desktop Validation and review Desktop Activity Desktop Access and automation Desktop Project settings Desktop Application settings Desktop Licensing and updates Desktop Security and storage Desktop Troubleshooting Desktop No results found