Soreno
FrançaisDownload

Security

What Soreno does on your machine

Soreno’s source code isn’t public. So this page states exactly what the app does on your machine and your servers, what it sends over the network, and what it doesn’t protect.

The basics

No account, no Soreno server

Soreno is a desktop app. Your projects never go through a Soreno server.

  • No account

    Soreno opens without sign-up or sign-in. The local Kanban works without an account; Linear is only an option.

  • No telemetry

    No usage statistics, no crash reports: Soreno doesn’t know how many sessions you start, or on which projects.

  • Your data in your profile

    Notes, settings, projects and local issues are saved on your machine, in the app’s data folder.

  • Your agents talk to their providers

    Claude Code, Codex, Pi and OMP send your prompts and your code to their providers, just as in your terminal. Soreno doesn’t sit in the middle.

Agents

Your agents stay the ones you installed

Soreno runs your CLIs in real terminals, or OMP in the Chat view if you pick it. It doesn’t replace them: they are the ones talking to their providers.

  • Your credentials stay with the agents

    Soreno doesn’t read Claude Code’s or Codex’s login files. For your quotas it asks the CLIs themselves: claude auth status and /usage, which calls no model, and codex app-server.

  • No permission bypassed

    Soreno adds neither --dangerously-skip-permissions nor --yolo: each agent keeps its own rules, and one that asks for your approval in the terminal asks in Soreno too. Soreno does add its own instructions, for example to create an issue when you ask for one, and access to a few folders (see The limits).

  • Your configuration isn’t rewritten

    To track session state, Soreno adds its hooks when each session starts (--settings for Claude Code, -c for Codex). Codex asks you to approve them: Soreno doesn’t skip that step.

  • Hooks to track state, nothing more

    To know whether Claude Code or Codex is working or waiting for your answer, Soreno has it run a short script at each step (turn start, turn end, permission request). The script writes the session state to a private file: it opens no port, never answers a permission request for you, and if it fails, the agent carries on. For Pi and OMP, an extension does the same job.

SSH

Your servers, through your OpenSSH

Soreno has no SSH client of its own: it calls your system’s ssh, with your ~/.ssh/config and your SSH agent.

  • No password saved

    Soreno keeps the host, user, port and the path of the key you chose, never the key itself or its passphrase. A protected key is unlocked with ssh-add.

  • The server’s fingerprint checked

    Every session requires a known fingerprint (StrictHostKeyChecking=yes): the one in your known_hosts, or the one you confirmed in Soreno after comparing it. If it changes, the connection is refused.

  • No agent forwarding

    SSH agent forwarding is off: the server can’t use your keys to connect anywhere else.

  • What gets installed on the server

    In ~/.cache/soreno: dtach, checked against its SHA-256 fingerprint, which keeps sessions alive while Soreno is closed, the soreno-attach script and the session tracking files (hooks, Pi and OMP bridge). Everything runs as your account: no sudo, no system service, no open port.

  • Sessions only your account can reach

    Each session listens on a Unix socket only your account can open. It keeps the last megabyte of terminal output, to show it again when you come back.

  • Ports forwarded locally

    Ports forwarded from the status bar listen on 127.0.0.1 only: the rest of your network can’t see them.

Data

What is saved, and where

The main data is in ~/Library/Application Support/com.soreno.notes on macOS and %APPDATA%\com.soreno.notes on Windows, logs in ~/Library/Logs/com.soreno.notes or %LOCALAPPDATA%\com.soreno.notes\logs. The interface also keeps a few preferences and caches in its WebView storage.

  • Notes, projects and local issues

    In SQLite databases, and settings in settings.json. Screenshots pasted into an issue are files alongside them. Linear issues, and the screenshots you add to them, are saved on Linear.

  • The Linear key in the keychain

    If you connect Linear, its API key goes into the macOS Keychain or the Windows Credential Manager, not into a file. Disconnecting deletes it.

  • What an agent gets from an issue

    Starting an agent from an issue gives it the description and the paths of its images, six at most. The agent sends what it reads to its provider, like any prompt.

  • On your servers and in WSL

    On an SSH server, Soreno’s files are in ~/.cache/soreno, pasted images included, and, if you group projects, in ~/.soreno/groups. Some attached images also go through a private /tmp/soreno-agent-* folder; in WSL, each session has its control folder in /tmp.

Network

The connections Soreno opens itself

This is the full list. Your agents, Git and your SSH servers open their own.

  • GitHub, for updates

    Once an hour, Soreno reads the latest.json file of published releases. It downloads the new version when you click Update.

  • GitHub, for skills

    To find out whether an installed skill changed, Soreno reads its repository tree through the GitHub API, with your GITHUB_TOKEN if it is set.

  • npm or Homebrew, for Codex

    To tell you about a new Codex version, depending on how you installed it.

  • Linear, if you connect it

    api.linear.app for issues, and its file servers for images. The key is only sent to Linear’s servers. Without Linear, no connection.

  • Images in your Markdown

    A remote image in a note or an issue description loads from its address, as in a browser. Elsewhere (conversations, comments, file previews), it stays a plain link.

  • And the tools it runs

    Your agents, Git, npx skills and omp update open their own connections: Soreno starts them, it doesn’t relay them.

Updates

Signed releases, installed when you decide

Every Soreno release is built, signed and published the same way.

  • Signed, then checked

    Every release is signed when it is built. Before installing it, Soreno checks the downloaded file’s signature against the public key it ships with: a modified file is rejected.

  • On your click, never behind your back

    Soreno looks for new releases on its own, but only downloads and installs one when you click. Restarting stops working agents locally and in WSL; over SSH, terminals keep running on the server, and so does Chat (OMP) on a Linux server.

  • Built by GitHub Actions

    Releases are compiled and published by continuous integration, to the public Soreno-Releases repository.

  • Signed and notarized on macOS

    The macOS app is signed with a Developer ID certificate and notarized by Apple.

The limits

What Soreno doesn’t protect

Better to know them before trusting it with your projects.

  • Data Soreno doesn’t encrypt

    Notes, issues and settings are saved in plain text. Their protection is your disk’s: turn on FileVault or BitLocker.

  • An agent acts with your rights

    An agent started in Soreno can do anything your account can, as in a terminal. Its safeguards are its own: Soreno doesn’t sandbox it further.

  • Extra folders open to agents

    To receive your comments and work across a project group, the agent gets access to folders beyond the project (--add-dir for Claude Code, writable_roots for Codex).

  • The commit message without approval

    Auto commit runs Codex without asking for approval, but read-only, with no shell, no web search and none of your configuration: all it can do is write the message.

  • Your account on the server

    An SSH session is shielded from the server’s other accounts, not from root or from programs running as your own account.

  • Windows not signed yet

    The Windows installer has no publisher certificate: Windows may warn about an unknown publisher. Updates are still checked as on macOS.

Check

Don’t take our word for it

The code isn’t public, but what Soreno does can be checked.

  • The macOS signature

    codesign -dvv /Applications/Soreno.app shows the certificate (Developer ID Application); spctl -a -vv /Applications/Soreno.app reports source=Notarized Developer ID.

  • The connections

    An application firewall such as Little Snitch or LuLu shows every connection Soreno opens: compare them with the list above.

  • The commands it runs

    ps -efww or Task Manager (Command line column) shows the CLIs Soreno starts and the options it adds to them.

  • The files

    Notes, settings, projects and the session list are in the folders listed above: open them, they are SQLite databases and JSON.

Found a flaw, or a doubt?

If you find a security flaw, or anything on this page seems wrong, write to contactsoreno.dev.

Open your first project in Soreno

Soreno runs the CLIs already installed on your machine, in WSL or on your servers. Your notes, settings and local issues stay in your profile.

Download for macOSDownload for WindowsOther platforms

The macOS app is signed and notarized by Apple. The Windows installer isn’t signed yet: Windows may report an unknown publisher.