How Work Wingman keeps your stuff safe (plain-language)¶
Work Wingman handles sensitive things: your logins, your job applications, your personal story. This page explains, in everyday language, how it protects them — and, just as honestly, which safety checks are still on the to-do list and not built yet.
The one-sentence version: Work Wingman runs on your computer like a normal program, keeps your passwords in a locked safe that never leaves the machine, and never sends off a job application without your explicit "yes."
What's protected today¶
It runs on your machine, not on a website¶
Think of Work Wingman like a desktop program (a word processor), not a website you log into. Its engine only listens on your own computer — the equivalent of an intercom wired inside your house that has no line to the street. Nobody on your Wi-Fi, and nobody on the internet, can dial in.
(For the curious: the app answers only at the address 127.0.0.1, which means "this computer, and
only this computer.")
Your passwords live in a locked safe only you can open¶
Your logins go into a vault — picture a safe bolted inside your house. Two things make it safe:
- The safe never leaves. The vault file stays on your machine and is deliberately kept out of any shared or uploaded files.
- The safe never hands out the combination. When the app needs a password to fill a form, it reaches into the safe inside its own head and uses it right then — it never announces the password out loud and never writes it into any message that leaves the safe. There is literally no button, anywhere, that says "read me a password."
So even if something managed to eavesdrop on the messages the app sends around inside your computer, there would be no password in them to steal.
Nothing gets submitted without your "yes"¶
Work Wingman can fill out a job application for you, but it will never hit Submit on its own. It's like a careful assistant who fills in the whole form, then stops and says "Ready for you to check — want me to send it?" Two rules are wired in and can't be switched off:
- Always ask before submitting. Every application waits for your review.
- Stop when unsure. If the app isn't at least 90% confident it filled a field correctly, it pauses and hands the wheel back to you instead of guessing.
A locked door on the risky and the private¶
A secret handshake now protects a whole list of things, not just one or two. The always-protected categories are: your money details (salary, take-home pay), your equity/stock-grant numbers, your personality/self-assessment answers, your demographic info (things like gender, race, veteran or disability status), your after-interview journal (how it felt, what was hard, your gut read), your connected-account key status, and your password vault. On top of that, anything that actually does something on your behalf — installing software, exporting or importing your whole data file, syncing to Google Drive, scanning your Gmail for interview invites, creating a YouTube playlist, spending your own paid image-generation credits — needs the same handshake, because those are actions a sneaky page should never be able to trigger silently.
Here's the idea. Imagine a friendly page in your web browser tried to be sneaky and tell Work Wingman's engine "hey, install some software," or "hey, show me those interview notes," or "hey, hand over the salary numbers." The engine would ask for today's secret password — a fresh random one generated every time the app starts and tucked into a private file that only you (and the real app) can read. A random web page can't read that file, so it doesn't know the password, so the answer is a flat "no." Only the genuine Work Wingman app knows the handshake.
(Your other everyday lists — saved jobs, application history, study materials — stay easy for the app to reach; those aren't on the sensitive list, so there's nothing to lock down there. Everything that IS on the sensitive list now shares one single lock, so adding a new sensitive feature later just means putting it behind the same handshake — no new lock design needed each time.)
A second pair of eyes on every change¶
Before any change to Work Wingman's code is saved for good, an automated reviewer (Codex) reads it and looks for bugs and security problems — the way a careful editor proofreads a letter before it goes out. Nothing ships without passing that review.
Tidy housekeeping¶
Sensitive files — the password vault, private settings — are on a permanent "never share this list", so they can't be accidentally bundled into the shared code. And a past slip where some junk files got shared was cleaned up and scrubbed from the record.
Ingredient checks — now switched on¶
Work Wingman is built partly from other people's software "ingredients" (packages). Every time code changes, the pipeline now checks each ingredient against a public list of known security flaws — think of it like a food-safety inspector who checks every delivery against a recall list before it goes in the kitchen. If an ingredient shows up on that recall list at a serious severity, the change is blocked until it's swapped for a safe version. A second robot (Dependabot) also checks the shelves every week and offers to swap in fresher ingredients on its own, so problems get caught before they even reach the recall list.
What's still planned (not built yet)¶
Being honest: several standard safety checks are on the roadmap but not switched on today. They're listed here so there's no illusion they already run.
- Automatic code inspectors. Tools that read the code hunting for security weak spots (CodeQL, Semgrep) — like spell-checkers, but for security bugs. Planned, not running yet.
- Deeper ingredient checks. Beyond the recall-list check that's already running, broader scanners (Trivy, OWASP Dependency-Check) would add a second, more thorough pass. Planned, not running yet.
- Leaked-secret alarms. A tool (gitleaks, plus GitHub's own secret scanning) that sounds an alarm if a password ever gets accidentally typed into the code. Planned, not running yet.
- Live break-in testing. A tool (OWASP ZAP) that pokes at the running app the way a burglar would rattle the doors and windows. Planned, not running yet.
- A security helper for the app-builder. A "security assistant" (a Semgrep MCP helper) so the developer can run these checks and fix issues right in place. Planned, not running yet.
Today's automated pipeline builds and tests the app on every change, and now also checks ingredients for known flaws. Code inspectors, leaked-secret alarms, and live break-in testing are the honest gaps still left, and closing them is the plan.
The short list of what's real today¶
| Protection | Real today? |
|---|---|
| Runs only on your machine, unreachable from the internet | Yes |
| Passwords stored in a vault that never leaves, never spoken aloud | Yes |
| Never submits an application without your review | Yes |
| Pauses when it's not sure | Yes |
| Secret handshake guarding money/equity/personality/demographic data, the vault, your interview notes, and any "do something real" action (install, export, sync, Gmail scan, playlist, spend) | Yes |
| Automated code review before changes ship | Yes |
| Sensitive files kept off shared code | Yes |
| Ingredient (dependency) recall-list check, blocks risky changes | Yes |
| Weekly ingredient freshness checks (Dependabot) | Yes |
| Automatic security scanners (code inspectors, secrets, live testing) | Planned, not yet |
Related docs¶
- docs/technical/security.md — the full technical version, with the exact files and the tool-by-tool roadmap.
- docs/plain/data-backup.md — how exporting/backing up your data stays safe, including the optional passphrase-locked Excel files.
- docs/ARCHITECTURE.md — how the pieces of Work Wingman fit together.
- OWASP Top 10 — the industry's plain list of the most common security risks, if you'd like to learn the fundamentals.