This is a single-user local tool. It binds to 127.0.0.1, not the LAN. Do not expose it through a tunnel or reverse proxy without a separate authentication design.

The implementation baseline was checked on 2026-10-23.

Node 24.22.1 includes the October security fixes. k6's upstream 2.3.0 binary was built with Go 1.26.8, so setup builds the same k6 source using Go 1.27.3 and golang.org/x/net 0.60.0 instead. The x/net override fixes the HTTP/2 advisories reported by the binary scanner. toolchains/k6/go.mod and go.sum pin the build graph. The Go release includes later security fixes. Sources: Node release, Go release history, k6 source.

All npm dependencies use exact versions and a committed lockfile. pnpm requires a 24-hour release age, rejects trust downgrades, and disables package lifecycle scripts. scripts/install-native.mjs explicitly prepares the selected SQLite, Claude, and PTY components. Bootstrap verifies official Node and Go archive SHA-256 values and pnpm package integrity. Go module downloads use the checksum database.

pnpm audit checks known npm advisories. It does not certify bundled CLI binaries, Go modules, every browser vulnerability, or future releases. Review provider release notes and repeat the checks when changing pinned versions.

The 2026-10-23 binary scan of the patched k6 build found zero affected symbols and zero affected imported packages. It also reported one module-only advisory, GO-2026-5932, for the unmaintained OpenPGP package. That package is not imported or called by this binary. Run ./studio audit:k6 to repeat the scan against the current advisory database.

• Exact Host and Origin checks, same-origin JSON requests, an HttpOnly SameSite cookie, and a CSRF nonce protect the local API.
• Private directories and Unix sockets restrict the runner and PTY to the local user.
• API keys stay in runner memory and are redacted from recorded output. Subscription credentials stay with the official CLI.
• Child environments exclude inherited provider keys and tokens. Codex API authentication uses ephemeral storage; it does not replace the subscription login.
• Preset permissions restrict Studio tools. Native provider execution, hooks, external MCP tools, and automatic subagents are disabled for Studio turns.
• Project file tools reject secret paths, escaping paths, and outside symlinks unless the agent uses Bypass permissions. Selected skill files are read from frozen snapshots.
• Read-only agents cannot use action tools, even when the run already has file-write approval. The default approval level asks for each shell command. Project automation pre-approves selected project writes and shell commands for that agent, without approving writes for other agents.
• Bypass permissions skips write, shell, and external target approvals for that agent. Its enabled file tools can access paths outside the project, including hidden and secret files, and shell commands run directly as the current OS user without the Codex sandbox. Tool selection, output redaction, time limits, and execution evidence remain in effect. Changing a preset does not change an existing run's permission snapshot or approve other agents.
• Other permission levels run shell commands through the Codex OS sandbox. A permitted command can access resources allowed by that sandbox, including networking. Studio is not a container or a defense against a malicious local user.
• Browser QA uses an isolated context with loopback-only requests, except Bypass permissions also allows external targets. HTTP external targets need approval unless bypass is selected. QA tools cannot address the configured Studio control port; this restriction does not constrain an unsandboxed shell.
• k6 is limited to loopback, at most 5 virtual users and 10 seconds, with redirects disabled. Agent turns and commands have time limits. Completed tasks stop their test servers and browsers.

Project files, prompts, skills, model output, and test evidence can contain private content. State is local plaintext protected by filesystem permissions. Do not publish .local/ or attach its logs to an issue without reviewing them.