1 Network & Authentication
LidBridge communicates exclusively with the GitHub API over HTTPS. All network traffic is limited to:
- OAuth callback — A local server on
localhost:2026handles the OAuth redirect from GitHub. This server is only active during the authentication process and does not accept external connections. - GitHub API requests — Authenticated requests to
api.github.comfor profile data, organizations, and repository listings.
No other network connections are made. LidBridge does not phone home, contact third-party servers, or transmit data to any endpoint other than GitHub.
2 Authentication Flow
LidBridge supports two authentication methods:
- OAuth App — A standard GitHub OAuth flow that requests only the permissions needed (read access to profiles, organizations, and repositories). The OAuth client ID and secret are embedded in the application.
- Personal Access Token (PAT) — Users can provide their own GitHub PAT directly. The token is validated against the GitHub API before use.
Both methods request the minimum scope required for LidBridge's functionality. No write permissions are requested by default.
3 Token Storage
GitHub access tokens are stored in a local SQLite database on your machine. In the current version, tokens are stored in plaintext within the database file.
Future improvement: Token encryption at rest is planned for a future release to provide an additional layer of protection. Until then, ensure your system has appropriate access controls to protect the database file.
The SQLite database is stored in the application's configuration directory, which is specific to your operating system.
4 Code Transparency
LidBridge is fully open source under the GPL-3.0 license. The entire codebase is available on GitHub for inspection, audit, and contribution.
- No obfuscated or minified code
- No hidden network requests
- No bundled telemetry or analytics SDKs
Security researchers and users are encouraged to review the source code to verify the claims made on this page.
5 Secrets Detection Engine
The secrets detection engine runs entirely locally. It uses pattern matching and entropy analysis to identify potential secrets in your files.
- No file contents leave your machine
- No cloud-based analysis or external API calls for detection
- Detection rules are embedded in the application
- Results are displayed locally and never transmitted
6 File System Safety
LidBridge is designed with file system safety as a core principle:
- Copies only — When LidBridge interacts with files, it works on copies rather than modifying originals.
- No direct writes — The application does not write to your source directories without explicit user action.
- Browse-only by default — Repository browsing involves read-only API calls and does not modify any files locally or remotely.
5 Known Security Considerations
We believe in full transparency. The following are known security considerations in the current version:
- Hardcoded OAuth credentials — The GitHub OAuth client ID and client secret are embedded in the application binary. While this is common for desktop OAuth apps, it means these credentials are publicly visible.
- No Content Security Policy (CSP) — The Electron webview does not currently enforce a strict Content Security Policy. This may be addressed in a future update.
- Plaintext token storage — As noted above, tokens are stored without encryption in the local SQLite database.
We are actively working to address these considerations in upcoming releases.
6 Reporting a Vulnerability
If you discover a security vulnerability in LidBridge, please report it responsibly:
- GitHub Issues — For non-sensitive bugs, use the issue tracker.
- GitHub Discussions — For questions or to discuss security topics, use Discussions.
Do not disclose security vulnerabilities publicly until a fix has been released. We aim to respond to all reports within 48 hours.