Security

The download

• The app is signed with a Developer ID certificate from Farnor Labs, LLC and notarized by Apple, so macOS checks it before it opens.
• The page that offers the download shows its SHA-256 checksum. Check your copy with shasum -a 256 Castiri.dmg, or with spctl -a -t open --context context:primary-signature -v Castiri.dmg to see Apple's verdict.
• The site and the download are served over HTTPS only, with strict security headers. The only third-party script is Parcetta's analytics tag, which counts page views and clicks on Download.

What agents can do, and how you control it

• You pick one permission mode for the team before it launches, and nothing is preselected on first run: ask before acting, accept file edits, auto mode, or skip all prompts. The first launch shows what each mode allows.
• Skip all prompts isn't offered for Gaitro projects, so shipping and deploying always stay with you.
• Claude Code asks whether to trust a folder before an agent starts in it, and Castiri tells you if the folder brings its own Claude Code settings.
• Agents can't read their own credentials. Each agent's settings and token live outside your project, in a private folder agents' file tools are denied.
• Every agent has its own token for Castiri's local server, and the server decides who is calling from that token alone. The server listens on your own computer (127.0.0.1) only.
• Actions that need you appear as cards in the team chat, with Allow once, Allow for this mission, or No.

Untrusted content

• Documents agents write are shown with scripts off and every outside request blocked, so a document can't load images or make network calls.
• Pages agents open in the Preview are limited to your project and your computer until you choose to load more.
• Team files from other people are read in a limited way, previewed before anything is added, list each new role with its tools, and never replace a role you already have. Role names can't carry file paths.

What Castiri can't do for you

• Castiri is not sandboxed. Agents are Claude Code sessions that act with your Mac account's permissions inside the limits of the mode you chose. Auto and skip-all modes can reach beyond the project folder.
• Agents can be wrong or be misled by what they read, such as a web page or a file in the project. Review what they do, work in a folder you can restore, and keep secrets out of inputs and instructions.
• Your files and conversations go to Anthropic through Claude Code. See the privacy policy.

Reporting a vulnerability

If you think you've found a security problem in Castiri or this site, email info@castiri.com with "Security" in the subject, and what you found and how to reproduce it. Please give us a reasonable chance to fix it before you share it publicly, and don't access data that isn't yours. We won't take legal action against good-faith research that follows this. We don't run a paid bug bounty.