Security

Nothing is shared until you pick it. Here is what that means. Golden Gate is pre-release, and the hardening checklist is finished before any public release.

What crosses the bridge

Crosses

Titles and goals
Outcomes: tests passed, commit made
File names touched
Command names
Closing message, redacted
Commits and PRs, with status

Stays on your machine

Projects you did not pick
Raw transcripts
Tool output
File contents
Command arguments
Paths outside the project

Default deny

Nothing moves until you pick it

One door

Every payload is checked on the way out

Exact previews

Read it before it goes

Redacted twice

Before and after summarizing

No telemetry

Only your server, never us

The model summarizer is opt-in

By default, fixed rules on your machine write every summary.

01
Your messages
Redacted first
Capped, and long sessions cut in the middle.
02
Your model
Off by default
It asks before turning on. A local model stays local.
03
A short summary
Redacted again
Fixed JSON shape, capped, stored as plain text.

Never sent to the model
Tool output
File contents
Command arguments
Projects you did not share

More about the model summarizer

What it receives. Your messages and the assistant's replies, after the same redaction as everything else, each capped, with long sessions cut in the middle. Only sessions of shared projects.
Previews stay offline. A preview never calls the model. It shows a model summary only if one was already made during a sync.
What comes back. An answer constrained to a JSON schema, redacted again and capped. It reaches your server only through the same validated path as every payload.
Keep it local. With an OpenAI-compatible endpoint on your machine, such as Ollama or LM Studio, nothing leaves it. Otherwise the provider sees the redacted text under its own terms.
Keys. Typed hidden and kept in the OS keyring, or read from the provider's environment variable. Never written to the config.

Three tokens, three jobs

No token can do another's job. Your assistant's can only read.

	`admin`	`ingest`	`read`
Manage tokens	Can	Cannot	Cannot
Write work data	Cannot	Can	Cannot
Delete work data	Cannot	Can	Cannot
Read through MCP	Cannot	Cannot	Can

How tokens are protected

The admin secret comes from GOLDENGATE_ADMIN_TOKEN: at least 32 random bytes, compared in constant time, never stored or logged. goldengate init keeps it in memory only.
Minted tokens are 256-bit random values with a prefix (ggb_read_, ggb_ingest_) so secret scanners can spot a leak. Only a SHA-256 hash is stored, and each is shown once.
Tokens can expire and be revoked; a revoked token is refused on its next request. Rotation mints a replacement and revokes the old one, optionally after a grace period.
Pairing codes are 60 bits, single use and expire after 10 minutes. Five failed exchanges burn every live code.
Repeated bad tokens lock an address out for a few minutes, with per-address and per-token rate limits on top.
Golden Gate Bridge refuses to start without credentials, and refuses plain HTTP on a public address unless TLS is configured or --behind-tls-proxy is given. Golden Gate refuses plain http:// except on loopback and never follows redirects.
/mcp refuses requests from browser origins it does not trust, so a web page cannot reach it through DNS rebinding. Assistants and CLIs send no Origin and are unaffected.
The audit log records token id, scope, action, project, time and source address. Never payload content. Retention defaults to 90 days.

OAuth, only if you turn it on

For assistants that cannot send a header. Without --oauth none of these endpoints exist.

01
A client registers
Anyone can ask
It gets nothing without your consent.
02
You approve
With your admin secret
The page names the app and where it goes.
03
It gets a read token
1 hour, then refreshed
A 30-day refresh token rotates. Reuse revokes the lot.

How OAuth stays safe

Who can approve: Only the holder of the admin secret. The consent page names the application and exactly where it will be sent.
What an assistant gets: An ordinary read token that lasts an hour, plus a refresh token that rotates and lasts 30 days. It can never write, delete or manage tokens.
If something is stolen: Codes are single use. Reusing a code or replaying a used refresh token revokes everything issued from that grant.
Open registration: Anyone who can reach Golden Gate Bridge can register a client, but it gets nothing without your consent. Registration is rate limited and capped, and --oauth-redirect-host narrows where clients may redirect.
The phishing risk: An attacker can register a client and lure you to its sign-in link. Check the application and redirect host on the consent page, and only approve connections you started yourself.

Where the data comes from

Coding tools

Read in place, read-only

Chat exports

Zip checked, never extracted

Chat history

Shared only by its own rule

Worktrees

Filed under a selected repository

How sources are read and checked

Coding tools: Claude Code, Codex and OpenCode are read in place, read-only. For OpenCode only four tables of its database are opened, enforced by a test; its credentials and account tables are never touched.
Chat exports: claude.ai and ChatGPT zips are untrusted input. An archive is refused if any entry could escape a folder, is a symlink or a duplicate, or looks like a zip bomb. Nothing is extracted to disk, and only the conversation files are read.
Chat history: Chats are more personal than code, so chat projects are shared only by an explicit rule, even when the default is to allow.
Worktrees: A worktree is filed under its repository only when that repository is selected, so the name of an unselected folder is never sent.

Prompt injection

Session text can contain instructions aimed at an AI. Golden Gate Bridge marks all of it as data.

What it does

Static tool descriptions
Random markers around stored text
Look-alike markers and control characters stripped
Read-only tools only

What it cannot do

Stop a model obeying text it was shown
Make a shell or email tool safe

Approve each action by hand, and keep sensitive projects at titles-only.

See how every answer is wrapped

What can still go wrong

A compromised server

The stored summaries leak. Keep sensitive projects at titles-only.

The read token

Sits in your assistant's connector settings.

Regex redaction

Can miss a secret. A model summarizer would see it too.

No OS keyring

The ingest token is a plain 0600 file, and Golden Gate says so.

Take it back

Stop sharing and delete from your servergoldengate share remove ~/code/myproject --purge-remote

Replace the assistant's tokengoldengate token rotate read

Cut off an OAuth assistantgoldengatebridge oauth clients delete <id>

Switch the model summarizer offgoldengate summarizer use heuristic

Found a problem? Use private vulnerability reporting, not a public issue. The full text is SECURITY.md.