Skip to content
GreatPing
Get started

Security

GreatPing sits between your coding agents and your phone. It is designed so that the service in the middle learns as little as possible and cannot act for you.

What never leaves your computer

When an agent waits, its hook sends the agent's name, the reason (a permission prompt, a question, a finished turn) and two opaque identifiers computed on your computer for the chat session and the prompt. That is the entire alert. The command, the question, file names and paths are never sent.

The project name is sent only if you turn project labels on, and then it is end-to-end encrypted. greatping run names the program and a plain-word subcommand, never the arguments, since they can hold tokens or paths.

End-to-end encryption

The text, title and choices of questions and messages you send, your answers and project names are encrypted on the device or computer that writes them, for the devices and computers of your account only.

  • Content is sealed once with a random key, and that key is wrapped for each recipient with HPKE (RFC 9180: X25519, HKDF-SHA256, ChaCha20-Poly1305).
  • The sender signs every envelope with its Ed25519 key, so the service cannot inject or alter a question.
  • Recipients come only from the account's signed member list, which your devices and computers verify themselves. The service cannot add a recipient.
  • A computer accepts an answer only if a device of the account signed it, for that very question, and it is one of the allowed choices. Anything else is refused.
  • On iPhone and iPad, a notification extension decrypts the content on the device. On Android, the notification carries only encrypted data, and the app decrypts it.

Pairing with a code

A computer joins your account only when one of your devices approves it. The pairing code, such as K7PD-M4XQ, has two halves. The first finds the pairing on the service. The second never reaches the service: the computer and your phone use it in a password-authenticated key exchange (CPace) to prove to each other that they saw the same code, before any key is trusted. A mistyped code, or keys swapped by anyone in between, ends the pairing with nothing added.

Before you approve, the app shows the computer's name and system, and where and when the pairing started. Adding another phone or tablet works the same way.

What the service can see

To deliver alerts, the service needs some information. It can see:

  • the names of your devices and computers, and their system and app versions;
  • which agent an alert comes from, why, and when it was opened, answered or finished;
  • opaque identifiers for chat sessions and projects, which do not reveal their names;
  • the approximate city, country and network of each device's and computer's latest activity.

It cannot read your questions, messages, answers or project names, and it cannot forge them. It stores long-lived credentials only as hashes and does not store IP addresses.

Protecting your account

  • Every membership change is announced. When a device or computer joins or leaves, your other devices get a security notice, and the change appears in Security Activity.
  • New devices wait. A device added less than 72 hours ago can remove only itself and what joined after it, so a newly added device cannot take over an account.
  • App lock. An optional GreatPing passcode, with Face ID, Touch ID or a fingerprint, confirms sensitive actions such as approving a computer, and can lock the app when it opens.
  • Computers have limited power. A computer can send alerts, read its own requests and pause its own alerts. It cannot add or remove members, change routing, or rename itself.
  • Hooks never decide. GreatPing's hooks only observe. They never approve or deny anything in your agent, and if they fail, the agent carries on.

Data minimization

Alert content is deleted 7 days after the alert finishes; the alert itself after 30 days. Deleting an account deletes everything in it within an hour. Usage analytics are off unless you turn them on. Details are in the Privacy Policy.

Open source

The command line tool, the protocol (including the encryption and pairing code) and the agent skill are open source, so you can read exactly what runs on your computer and what it sends.

Report a vulnerability

Please report security problems privately, through GitHub private reporting or by email to security@greatping.com. Do not open a public issue.

Include the affected version, steps to reproduce with test data, and the impact you expect. Never send a real credential, account database or private prompt. We investigate privately, fix and verify, and coordinate disclosure with you. GreatPing is in preview: there is no bug bounty and no guaranteed response time yet, but we read every report.