CodeFly Security

CodeFly is designed around a simple rule: coding session content should be readable only by the user's phone and the user's own host computer.

Summary

• CodeFly Host runs on the user's computer, next to Codex and Claude Code.
• The mobile app connects through Direct Mode, a user-managed network path, or CodeFly Relay.
• Host communication is secured by the host-side certificate and endpoint pairing material.
• CodeFly does not have access to the host certificate private key.
• CodeFly cannot access any data transmitted between the host and phone, and does not record transmitted content.

Architecture

Direct Mode

Direct Mode connects the phone directly to CodeFly Host. It does not require OAuth sign-in and does not route session traffic through CodeFly Relay. The host listens on the configured address and port, and the phone must be able to reach that network endpoint.

Self-Hosted Reachability

Users can operate their own VPN, TCP proxy, SSH tunnel, private overlay, reverse tunnel, or similar network path and keep using Direct Mode. The user-managed network path may observe network metadata such as source, destination, timing, and traffic volume, but CodeFly application payloads remain protected by the phone-to-host security boundary.

CodeFly Relay

CodeFly Relay exists for practical reachability problems such as NAT, changing IP addresses, restrictive networks, travel, and hosts that cannot accept inbound connections. The Relay forwards encrypted frames and uses routing metadata only as needed to deliver traffic, check subscription entitlements, maintain reliability, prevent abuse, and provide support.

Host Certificate

The secure connection between the mobile app and CodeFly Host uses a host-side certificate. By default, CodeFly Host generates and stores this certificate locally on the host computer. CodeFly does not issue, store, or have access to the host certificate private key.

The host certificate is independent from CodeFly Relay. When CodeFly Relay is used, the Relay forwards traffic between endpoints, but it does not receive the host certificate private key and cannot use it to decrypt host-phone communication.

What CodeFly Relay Does Not Store

CodeFly Relay does not store plaintext transmitted content such as prompts, assistant responses, source code sent through CodeFly frames, command output, approval prompt details, choice question details, diffs returned inside encrypted app frames, provider-native session databases, or provider account tokens stored by Codex or Claude Code on the user's computer.

Endpoint Responsibility

CodeFly protects traffic between endpoints, but endpoint security still matters. If the phone or host is compromised, CodeFly cannot protect content from that compromised endpoint. Users should protect their devices, provider accounts, API keys, local networks, and approval decisions.