Security fixes cover the latest release.

Do not open a public issue. Use a private repository security advisory with versions, reproduction steps, and impact. If unavailable, use the maintainer's GitHub-profile contact address.

UI access grants the Herdr World user's authority: terminals, repository hooks, session data, and workspace uploads/deletions. This is privileged administration, not a sandbox or multi-user permission system.

The default bind is 127.0.0.1. Every listener requires login, including 127.0.0.1, localhost and ::1. Configure HERDR_WORLD_PASSWORD with 8–1024 characters or use the generated persistent token. Passwords of at least 15 characters are recommended beyond a trusted private network; startup warns when a configured password is shorter. Successful login creates a bounded session signed with a separate random key in private World storage. Changing the password, generated token or configured PIN rotates that key and invalidates existing sessions; ordinary restarts preserve sessions. Repeated login failures receive a cooldown.

HERDR_WORLD_PIN optionally enables a 6–12 digit convenience login for trusted private networks or VPNs. It does not replace the password or generated token. PIN failures have separate per-client limits and a global one-hour cooldown; password/token recovery remains available during a PIN lockout.

Do not expose Herdr World directly to the public internet. For non-loopback:

• Set a strong HERDR_WORLD_PASSWORD; prefer it to --password, which exposes secrets in process arguments.
• Use HTTPS or a trusted VPN; restrict access with a firewall/reverse proxy.
• Treat worktree hooks as executable code.

The service automatically rejects privileged browser HTTP and WebSocket requests whose Origin authority does not equal their request Host authority. A loopback listener also rejects a non-loopback Host authority, preventing a public name from being treated as the local application through DNS rebinding. This needs no user-maintained allow-list. An independently authenticated HTTPS reverse proxy to loopback must preserve its public Host and configure that one exact external origin with HERDR_WORLD_PUBLIC_ORIGIN (or --public-origin). Originless native clients remain admissible, so listener access and authentication are still security boundaries. Configure native HTTPS or terminate TLS at a trusted proxy. Login throttling applies to authentication attempts. The service supplies no multi-user authorization or sandboxing.

Built-in sources act with the service user's own access: GitHub through that user's gh sign-in, and Jira with the account email and API token saved in Settings → Sources. The token is kept in a separate owner-only file in private World storage, never in settings.json, and is never returned to the browser. Changing the Jira site or email removes the saved token, so it is only ever sent to the site it was entered for. Anyone who can sign in to World can see the user's pull requests and tickets, and can replace or remove the token.

Merging, closing or marking a pull request ready from World runs gh with the service user's sign-in after a confirm in the browser. Merge is pinned to the head the viewer saw and never bypasses branch protection. These verbs are on the browser's World API only, not on the herdr-world CLI, the agent skill or MCP. That is a convention, not a boundary: agents run as the same user with the same gh sign-in, so "only the owner merges" is a crew rule World does not enforce.

Updates trust the configured HTTPS release origin (or explicit loopback test mirror) and its manifest/checksums. Checksums detect corruption and bind the archive, not independently verify publisher identity. Custom mirrors are trusted executable-code infrastructure.

Update requests require normal listener authentication plus x-herdr-world-update: 1. That header does not replace login.