Legal

Security

Last updated October 15, 2026

We take security seriously and appreciate responsible disclosure.

Report a vulnerability

Please report security issues privately through a GitHub security advisory, not in public issues. Include the version, steps to reproduce and the impact you expect. We aim to acknowledge reports within 3 business days.

Verify your download

Every release lists the SHA-256 checksum of the installer. On Windows, compare it with:

Get-FileHash .\SwarmCode-Setup-*.exe -Algorithm SHA256

Only download SwarmCode from this site or the project's GitHub releases. Early Windows builds aren't code-signed yet; signed builds are planned.

How SwarmCode protects you

• Edits and commands need your approval unless you turn on autonomous mode.
• Agents work in isolated git worktrees; changes reach your files only when you apply them.
• A security gate checks each change for new secrets, injection risks and unsafe settings.
• Content from web pages and files is treated as data, never as instructions.
• The desktop app runs its interface sandboxed, with context isolation and a strict content security policy.

More detail is in the project's security policy.