docs / 15

Safety and privacy

What stays on your computer

Kadhai listens only on your own computer (localhost), and refuses requests from any other machine and from other websites.
Your files never leave the folder except as part of prompts: the files a step needs are sent to the AI provider handling that call. Add keys only for providers you are comfortable sending your code to.
Keys, tokens, connection settings and flow credentials are encrypted before they are saved. On Windows the master key is tied to your Windows account; elsewhere it is a file only you can read. A program already running as you could still read them. Deleting secret.local.key makes every saved secret unreadable, and you would add your keys again.

Running code

The crew can run commands it writes, such as tests. By default each one waits for your OK.

Command mode	The crew's commands	Your own commands
Ask (default)	wait for your OK	run straight away
Run freely	run straight away	run straight away
No commands	refused	refused

Commands start in the folder, are stopped after a time limit (or when you press Kill or stop the run), and never receive your API keys.
A short blocklist refuses obviously destructive commands, but it is easy to get around. Without the Docker option, commands are not sandboxed: they run with your account's permissions and can reach anything you can. Read commands before you approve them.
Docker sandbox (optional). Set EXEC_SANDBOX=docker in .env and every command runs in a throwaway container that sees only the folder and has no network. If Docker is not running, commands are refused rather than run on your machine. Docker Desktop itself needs a few GB of memory.

Pages the crew makes

Generated web pages are served on a separate port (http://localhost:4748), so their scripts cannot reach Kadhai's controls. Files are only served from inside the folder, never through a link that leads elsewhere.

This page comes from the user guide in the repository. Something unclear or wrong? Tell us.