Only the latest published release receives security fixes.

Use GitHub private vulnerability reporting.

Do not open a public issue for:

• Credential or account-data exposure
• Workspace-boundary bypasses
• Local WebSocket or preview-bridge access
• Updater signature failures
• Unsafe Git or terminal behavior

Include the app version, Windows version, reproduction steps, impact, and whether the issue occurs with KIMI_FAKE=1. Never include real tokens, credentials, private source files, or unrelated personal data.

Kimi Code Desktop delegates authentication, model access, agent execution, sessions, commands, skills, subagents, MCP configuration, plugins, and subscription quota to Kimi Code CLI. The desktop app must never read or copy credential contents. If the CLI is missing, the app opens the official installation guide only after a user action and does not execute a remote installer.

Chats created by discontinued runtime adapters are compatibility data. They can be read, exported, archived, or deleted, but cannot start or resume agent work.

The primary local orchestration service:

• Binds only to 127.0.0.1
• Validates the Tauri or configured development origin
• Requires a random per-launch token in packaged builds
• Validates workspace file paths and sizes
• Allows bounded read-only access only to the active Kimi session's own background-task record and output.log
• Installs a local skill only from a validated non-symlink source inside the active workspace after confirmation
• Treats skill_install_local as a request that still requires explicit confirmation in the normal app window
• Reads trusted user MCP definitions from the selected Windows Kimi instance's effective KIMI_CODE_HOME
• Discovers project MCP only from .mcp.json and .kimi-code/mcp.json beneath the canonical project root
• Requires explicit local approval of a fingerprint covering the canonical root, fixed file presence, and exact bytes; any change requires reapproval
• Rejects project MCP policy changes while affected runtimes have active or pending work and resets those runtimes before applying the new policy
• Does not support project MCP approval for WSL Kimi instances
• Preserves trusted user definitions unless an approved, attachable project definition overrides the same name; unsupported project entries cannot suppress them, and the built-in preview name remains app-owned
• Keeps raw MCP URLs, headers, environment values, arguments, and credentials out of the renderer and remote clients

Optional remote access uses a separate listener that is disabled by default. Pairing codes are single-use and expire after ten minutes. Device tokens are random, stored only as hashes, rate-limited, and individually revocable. Remote devices use a restricted chat-control method set and cannot invoke login, updates, terminal, Git, filesystem, skill installation, diagnostics export, remote administration, or project MCP approval and revocation. Project MCP approval metadata is also omitted from remote capability responses. Kimi Code Desktop does not open firewall or router ports and does not provide a public relay.

Background-task records must resolve beneath the matching Kimi session and contain a validated finite task identifier. Monitoring expires after 24 hours and excludes tools that explicitly disable their timeout. A terminal state and bounded outputPath are recorded and surfaced to the UI after recovery. Completion never enqueues a prompt or invokes a model. The user must explicitly inspect the output or ask Kimi to inspect it.

The desktop preview accepts HTTP or HTTPS only when the hostname is exactly localhost or 127.0.0.1. Screenshot capture uses a fresh temporary Microsoft Edge profile that is removed after capture. It never reuses a personal browser profile, cookies, extensions, or signed-in sessions.

Published updates are signed with the Tauri updater key stored in GitHub Actions secrets. Tauri signing does not replace Microsoft Authenticode. Windows may show SmartScreen warnings until Authenticode is configured.

Maintainers will acknowledge a complete report, investigate privately, and coordinate a fix and release before public disclosure when practical. Please allow reasonable time for verification and distribution.