Security
Last updated: July 11, 2026
DorkOS is made by Blaze Ventures, LLC. It is an early open-source alpha, and we would rather tell you exactly how it works than make it sound safer than it is.
The short version
- DorkOS runs on your own computer. By default it has no login and listens only on your machine.
- To reach it from your phone or another device, you turn on a real login first. That is enforced, not a suggestion.
- Found a security problem? Email security@dorkos.ai. Please do not post it publicly until it is fixed.
Your machine is the line
DorkOS is a cockpit for AI agents that run on your own computer. The one idea that explains everything else: your machine is the trust boundary. By default there is no account and DorkOS answers only to your own computer, the same way other developer tools do. It does not try to protect you from other software you already chose to run under your own user. It protects the line between your machine and everyone else.
Reaching DorkOS from elsewhere requires a login
The moment you want to reach DorkOS remotely, by starting a tunnel or opening it to your network, it becomes a networked service. So DorkOS requires an owner account before it will do that. Start a tunnel with login off and it walks you through creating one first. Bind to a public network address with no login and it refuses to start. Remote visitors get a sign-in screen, and every request needs a valid session.
Running an agent is a real act of trust
Agents can read and write files and run commands inside the boundary you give them. Installing a package from the Marketplace runs that package's code on your machine. We fetch packages over safe channels and roll back a failed install cleanly, but we do not yet verify a package signature for you. Install packages the way you would run any script from the internet: only from authors you trust.
Your AI keys, your data
You bring your own AI keys. Your prompts and code go straight to the model vendor you chose, under their terms. DorkOS passes it along and keeps no copy. See our Privacy Policy for the full picture.
Reporting a vulnerability
If you think you have found a security issue, please tell us privately first. Email security@dorkos.ai or use the private "Report a vulnerability" button on our GitHub Security page. We are a tiny team, so we aim to reply within three business days and fix confirmed issues before moving on to new features. We will credit you if you would like.
The full policy lives in SECURITY.md, and the detailed threat model explains what DorkOS trusts and where the sharp edges are.
When this changes
DorkOS moves fast. When how it handles security changes, we update this page and change the date at the top. No quiet edits.