Security

What Jaggery listens on, what it sends out, how machines come to trust each other, and what isn't protected yet. We'd rather you read this before installing than find out later.

What it listens on

Port	Who can reach it	What
`80`	your home network	The page and `ai.local`, when the machine allows it. On Linux the installer grants just that, not root.
`7373`	your home network	The same page and `ai.local`, and what machines show each other before they trust each other.
`7374`	approved machines only	Mutual TLS between Jaggery machines.
`5353/udp`	your home network	mDNS: finding machines, answering for `jaggery.local` and `ai.local`.

Nothing is opened on your router. If a firewall is on, the installer opens these to your local network only.

What leaves your house

Update checks. Each machine asks GitHub for a new release every 30 minutes. jag update --policy off stops it.
Hosted models, only if you add one, and only to the providers and models you list, up to the spending cap you set. Every request is kept word for word: jag outbound.

Nothing else. No telemetry, no account, no crash reports.

How machines trust each other

A code, or your approval.: Seeing a machine on the network doesn't make it trusted. It joins with a six-word code from jag invite, which works once and expires, or when you run jag approve.
Its own keys.: Each machine makes a key pair the first time it runs. Machines remember each other's keys and talk over mutual TLS.
New models wait.: A model that turns up later isn't served on ai.local until you approve it, and approval is tied to its files.
Updates are signed.: Each machine installs a build only if it carries Jaggery's signature, even when it comes through another machine in the house. Machines update one at a time, and a build that won't start is rolled back.
Shared folders stay put.: Read-only unless you say otherwise. Hidden files and key files are never served. Old versions are kept for 30 days, and every access is logged.

Web pages and the internet

Trusting the people in your house doesn't mean trusting every web page they open. Jaggery answers only devices on your home network, only when it's asked for by a local name such as jaggery.local or by its address, and it refuses a web page's attempts to change anything. A page on the internet can't use your models or read your shared folders through someone's browser, and a machine with a public address doesn't answer the internet.

What isn't protected yet

Everything on your home network is trusted.Like a printer: anyone on it can use ai.local, your shared folders and any hosted allowance, up to its cap. There are no accounts. Put guests and smart devices on a separate network.
Another device can answer for ai.local.The names work over mDNS, which any device on the network can answer. Apps that hold secrets can use a machine's own name instead.
The page has no sign-in.It shows your machines and activity. It can't change anything.
Local names are plain HTTP.Traffic between Jaggery machines is encrypted; traffic from your phone to jaggery.local isn't.
Releases are signed with a key, not yet keyless.Each machine installs only builds signed with Jaggery's key. Signing tied to the public build log comes at the launch.

Found a problem?

Please write to hello@jaggery.dev with "security" in the subject, rather than posting it publicly. Tell us what you found and how to reproduce it. A person will reply within two working days, agree a fix and a date with you, and credit you unless you'd rather not be named.