Security

OxideTerm keeps its desktop UI, terminal state, and core services in one Rust process. GPUI renders native state directly, so normal desktop operations do not cross a browser or UI serialization boundary.

Rust SSH and Cryptography

OxideTerm uses russh with the ring cryptography backend:

• No OpenSSL or libssh2 dependency in the SSH stack
• SSH key exchange, channels, SFTP, forwarding, and supported modern ciphers
• Ed25519, ECDSA, RSA, SSH certificates, and system SSH Agent support
• Sensitive owned buffers wrapped with zeroize/Zeroizing where they cross credential boundaries

Rust memory safety reduces classes of memory corruption bugs, but it does not replace protocol review, dependency updates, host-key verification, or careful secret handling.

Credential Storage

Passwords, private-key passphrases, API keys, and supported plugin or sync secrets are stored through the operating system keychain:

Platform	Keychain
macOS	Keychain Access
Windows	Windows Credential Manager
Linux	Secret Service provider, such as GNOME Keyring or KWallet

Secret-bearing Rust types use redacted debug output. Secret values must not be included in logs, diagnostics, reports, error messages, or command-line arguments.

Encrypted Local State

Saved connection metadata and related local state are protected separately from credentials:

• Credential values remain in the OS keychain.
• The saved connection document is encrypted with ChaCha20-Poly1305.
• Its local encryption key is stored in the keychain layer.
• Older supported plaintext data is migrated into protected storage.

Use oxideterm paths --json to inspect active file locations without exposing credentials.

.oxide Bundle Encryption

Portable .oxide exports use:

• ChaCha20-Poly1305 authenticated encryption
• Argon2id password derivation with a 256 MB memory cost and four iterations
• Integrity checks before import or apply
• Optional inclusion of portable secrets inside the encrypted payload

Preview an import before applying it:

oxideterm oxide validate ./profile.oxide
oxideterm oxide preview-import ./profile.oxide --password-stdin --json

Supply passwords through standard input or an environment variable so they do not appear in shell history or process listings.

SSH Host Trust

OxideTerm implements Trust On First Use with OpenSSH-compatible known-host behavior:

• A first connection can store the presented host key.
• Later connections verify the key against the stored value.
• Unexpected key changes are rejected and require explicit investigation.
• ProxyJump hops retain their own authentication and trust decisions.

SSH Agent access uses SSH_AUTH_SOCK on macOS/Linux and the OpenSSH agent named pipe on Windows. Agent Forwarding is optional and should be enabled only for hosts you trust.

Native Process Boundaries

Terminal bytes flow from Rust session backends into Rust-owned TerminalState, then into the GPUI painter. Desktop management actions call domain services in process. There is no localhost terminal bridge or desktop management protocol to authenticate and expose.

The optional remote IDE agent is different: it runs on a selected remote host and communicates through a channel inside the existing authenticated SSH connection. It does not open an external listening port, and IDE mode can fall back to SFTP when the agent is unavailable.

Plugin Security

Native plugin packages are validated before activation. For WASM plugins:

Layer	Protection
Runtime	wasmtime executes the guest module outside native application memory
Manifest	Entry types and contributions must match the supported native schema
Capabilities	Filesystem, SFTP, forwarding, and other effects require declared permissions
Host API	Rust handlers validate permissions again before executing effects
Secret boundary	Host projections omit provider keys and other secret values

Declared process plugins are native executables and therefore have a different trust boundary from WASM guests. Review the publisher, manifest, requested capabilities, and executable before enabling one.

CLI Safety

The oxideterm CLI links directly to domain crates and does not require a running desktop app. Its safety model includes:

• --dry-run plans and --yes confirmation for most writes
• Rollback backups for supported state-changing operations
• --strict modes for CI health checks
• Stable machine-readable error codes through oxideterm errors --json
• Redacted diagnostics, reports, and support bundles
• Standard-input or environment-variable secret ingestion instead of plaintext secret arguments

Review support bundles before sharing them even though the report pipeline is designed to redact credential-like values.

AI Context and Privacy

• OxideTerm does not collect usage telemetry.
• Core SSH and local workflows do not require an OxideTerm account.
• OxideSens uses the provider you configure, including local Ollama endpoints.
• Credentials are redacted before workspace context is constructed for a model or tool.
• Terminal buffers, files, configuration, and diagnostic details should be sent only when they are relevant to the action you approve.
• Cloud Sync is optional and uses the backend you configure.