Security Implementation

🔐 Security Implementation

This guide details the security measures implemented in the Acode AI CLI Assistant Plugin to protect your data and privacy.

🎯 Overview

The plugin implements robust security measures to ensure your API keys and data remain protected while providing powerful AI-assisted coding capabilities.

🔒 API Key Encryption

AES-GCM Encryption

All API keys are encrypted using Advanced Encryption Standard (AES) in Galois/Counter Mode (GCM):

async _encrypt(value) {
  const key = await this._importKey(this.secret);
  const iv = crypto.getRandomValues(new Uint8Array(12)); // Initialization vector
  const encrypted = await crypto.subtle.encrypt(
    {
      name: "AES-GCM",
      iv: iv
    },
    key,
    this._encode(value)
  );
  return { iv, encrypted };
}

Benefits

• Confidentiality: Data is encrypted and unreadable without the key
• Integrity: GCM mode provides authentication to detect tampering
• Performance: Efficient encryption suitable for mobile devices

PBKDF2 Key Derivation

Your passphrase is processed through PBKDF2 (Password-Based Key Derivation Function 2) with 100,000 iterations:

async _importKey(secret) {
  const keyMaterial = await crypto.subtle.importKey(
    "raw",
    this._encode(secret),
    { name: "PBKDF2" },
    false,
    ["deriveKey"]
  );
  const key = await crypto.subtle.deriveKey(
    {
      name: "PBKDF2",
      salt: this._encode("salt"),
      iterations: 100000,
      hash: "SHA-256"
    },
    keyMaterial,
    { name: "AES-GCM", length: 256 },
    true,
    ["encrypt", "decrypt"]
  );
  return key;
}

Security Features

• Strong Derivation: 100,000 iterations make brute-force attacks difficult
• Salt Usage: Random salt prevents rainbow table attacks
• SHA-256 Hashing: Cryptographically secure hashing algorithm

🗃️ Secure Storage

Local Storage Isolation

Encrypted API keys are stored in Acode's local storage with provider-specific keys:

// Save encrypted key
localStorage.setItem(provider, JSON.stringify(storageValue));

// Retrieve encrypted key
const storageValue = localStorage.getItem(provider);

Protection Measures

• Scoped Storage: Keys are isolated from other plugins
• No Plain Text: Keys are never stored without encryption
• Provider Separation: Each provider has its own storage key

Data Format

Stored data includes both the encrypted key and initialization vector:

const storageValue = {
  iv: Array.from(iv), // Initialization vector
  encrypted: Array.from(new Uint8Array(encrypted)) // Encrypted data
};

🌐 Secure Communication

HTTPS Enforcement

All API communications are enforced over HTTPS:

// Example API call
const response = await fetch("https://api.openai.com/v1/models", {
  headers: {
    Authorization: `Bearer ${apiKey}`,
    "Content-Type": "application/json"
  }
});

Security Benefits

• Data Encryption: All data in transit is encrypted
• Server Authentication: Ensures you're communicating with the real provider
• Integrity Protection: Prevents data modification during transmission

Header Security

API requests use secure headers to prevent information leakage:

headers: {
  Authorization: `Bearer ${apiKey}`, // Secure authorization
  "Content-Type": "application/json" // Proper content type
}

🧹 Data Protection

In-Memory Data Handling

Sensitive data is handled carefully in memory:

// Secure text encoding/decoding
_encode(text) {
  const encoder = new TextEncoder();
  return encoder.encode(text);
}

_decode(buffer) {
  const decoder = new TextDecoder();
  return decoder.decode(buffer);
}

Session Data Management

Conversation history is also protected:

// History items are stored with context
const historyItem = {
  prompt: userPrompt,
  result: aiResponse
};

🔍 Privacy Features

No Telemetry

The plugin collects no usage data or telemetry:

• Zero Tracking: No user behavior monitoring
• Local Processing: All data processing happens locally
• No Analytics: No third-party analytics services

Data Minimization

Only necessary data is sent to AI providers:

// Context-aware prompts include only relevant information
const systemPromptWithContext = `AI assistant for Acode editor. 
Current: ${currentFileName} (${currentFileExt}) at line ${cursorPos.row + 1}. 
Can edit/create/delete files, run terminal commands. Use context in responses.`;

User Consent

All data transmission requires explicit user action:

• Manual Queries: Users must actively send queries
• Code Selection: Only selected code is processed
• Clear Indicators: Visual feedback when AI is processing

🛡️ Security Architecture

Encryption Layers

Multiple layers of security protect your data:

1. Passphrase Protection: User-defined passphrase
2. Key Derivation: PBKDF2 processing
3. Data Encryption: AES-GCM encryption
4. Secure Storage: Local storage isolation

Access Controls

Security measures control access to sensitive data:

• Passphrase Required: For encryption/decryption operations
• Provider Isolation: Each provider's keys are separate
• In-App Only: Keys cannot be accessed outside Acode

🔧 Security Configuration

Passphrase Management

Users can manage their encryption passphrase:

// Passphrase is used for all encryption operations
const apiKeyManager = new APIKeyManager(passphrase);

Best Practices

• Use a strong, unique passphrase
• Remember your passphrase (it cannot be recovered)
• Change passphrase periodically for enhanced security

Key Rotation

The plugin supports key rotation:

// Delete old key
deleteAPIKey(provider) {
  localStorage.removeItem(provider);
}

// Save new key
saveAPIKey(provider, apiKey) {
  // Encrypts with current passphrase
}

📈 Security Monitoring

Usage Tracking

The plugin monitors API usage without compromising privacy:

• Token Counting: Tracks token consumption
• Request Logging: Logs request types locally
• Error Reporting: Reports errors without sensitive data

Security Audits

Regular security checks include:

• Encryption Validation: Ensures keys remain encrypted
• Storage Integrity: Verifies local storage protection
• Communication Security: Confirms HTTPS usage

🐛 Troubleshooting Security Issues

Common Problems

Decryption Failures

• Wrong Passphrase: Cannot decrypt with incorrect passphrase
• Corrupted Storage: Data storage issues
• Browser Incompatibility: Older browsers may lack crypto support

Storage Problems

• LocalStorage Limits: Storage quota exceeded
• Permission Issues: Device storage restrictions
• Data Corruption: Unexpected storage modifications

Communication Errors

• Certificate Issues: SSL/TLS problems
• Network Restrictions: Corporate firewall interference
• Provider Changes: API endpoint modifications

Security Verification

To verify security implementation is working:

1. Set a passphrase and API key
2. Check that key is encrypted in storage
3. Verify key can be decrypted with correct passphrase
4. Confirm all API communications use HTTPS

💡 Security Best Practices

For Users

1. Strong Passphrases: Use complex, memorable passphrases
2. Regular Updates: Keep plugin and Acode updated
3. Secure Networks: Use trusted WiFi networks for API calls
4. Key Management: Rotate API keys periodically

For Developers

1. Code Review: Regular security-focused code reviews
2. Dependency Updates: Keep all packages updated
3. Encryption Validation: Test encryption/decryption regularly
4. Secure Defaults: Implement secure settings by default

For Enterprise Use

1. Local AI: Use Ollama for maximum privacy
2. Custom Endpoints: Implement private API gateways
3. Access Controls: Restrict plugin installation to approved users
4. Audit Trails: Monitor plugin usage through Acode logs

📞 Getting Help

If you encounter security issues:

1. Check the Common Issues documentation
2. Visit our GitHub Issues page
3. Join our Discussions community for support

---

🏠 Home | ⬆ Back to Top | 🤝 Contributing Guidelines