Security Model

Understand Conductor’s local-first security posture, secret handling, and isolation boundaries.

Conductor’s security story is intentionally simple: fewer hosted surfaces and clearer local boundaries.

​

Security properties

• no database by default
• no cloud execution requirement
• webhook HMAC verification
• MCP over stdio
• secrets stay in the environment
• per-task worktree isolation

​

Operational implications

Your real security posture depends on:

• the host machine running the orchestrator
• the agents installed there
• the network path used for remote access
• how carefully you protect repo-local configuration and credentials