Security and authorization

Qoder CN can work with local code, installed extensions, remote connections, and external services. Use the following checks to keep the account and data scope clear before a task begins and before its result is shared.

​

Protect your account and device

• Sign in only on devices you control, and sign out before handing a device to another person.
• Keep Qoder CN and the operating system updated.
• Lock the device when unattended. A running task can continue to use resources available on that device.
• Review the account shown under Settings → Profile before working with organization data.

​

Keep credentials out of tasks

Do not paste passwords, API keys, access tokens, private keys, or production connection strings into task instructions. Use the authentication flow or environment mechanism supported by the service. If a credential appears in a file, task output, screenshot, or exported record, remove it from shared artifacts and rotate it through the issuing service.

​

Review extensions and connections

Before installing or importing a Skill, Plugin, or Connector:

1. Confirm the publisher and intended capability.
2. Review scripts, Hooks, commands, endpoints, and external dependencies.
3. Check which account and workspace an external service will access.
4. Test with a small read-only operation.
5. Remove the extension or revoke its authorization when it is no longer needed.

For SSH workspaces, verify the host entry selected under Settings → Connections. For custom MCP servers, review the configuration saved in ~/.qoder/settings.json.

​

Review outputs before sharing

Inspect generated code, commands, files, screenshots, and exported task records before sharing them. Remove customer data, internal addresses, repository details, and credentials that are not required by the recipient. Use Code security to scan code changes for security risks. Security scans help review code, while account, credential, and external-service authorization still require separate checks.

​

Respond to suspicious activity

Stop the task, disconnect the affected service, and rotate exposed credentials. Preserve the relevant time, task, error, and service logs without copying secrets into a report. Contact the account or organization administrator when access may have crossed the intended boundary.