What you trust when you use DelorunCopy Anchor Link

English | 中文

SummaryCopy Anchor Link

This page helps you decide what you are comfortable with. It says, party by party, what each one can see and do when you use Delorun, and how to check it yourself. You need nothing first, but it reads best after Install and first run.

Delorun runs on your computer, as you. Nobody else runs it for you, and Delo Run, the project that publishes it, has no way into your studio. Delorun has no telemetry: it sends nothing about you. Two small checks that keep your installation honest talk to the internet by default. Everything else leaves your computer only when you turn it on.

ContentsCopy Anchor Link

• What runs on your computer
• What Delo Run can and cannot do
• What each reach option shows its provider
• What leaves your machine
• Checking it yourself
• Reporting a problem
• For the technically curious

What runs on your computerCopy Anchor Link

• Delorun itself. The studio and its plugins run as your user, with your user's access. Any other program you run as yourself can read everything in your home, the folder ~/.delorun, and Delorun cannot stop that.
• Commands the model runs. They run with your access too, inside the sandbox: a set of operating-system rules that limits what a command can touch. The sandbox keeps commands from writing into Delorun's home. Where your system supports it, it also keeps them from reading Delorun's secrets or reaching Docker. The one part of Delorun's home they can read besides installed releases, skills and runtimes is the approved copies of your profile's plugins; they cannot change those. Commands can still use other local services and the network, unless you set the workspace's network setting to Allowlist or Off (Prompt injection and data exfiltration). What Delorun protects lists the rules on each system, and on Linux delorun doctor shows whether the sandbox can run.
• Every workspace runs on your computer directly. Delorun has no Docker workspaces, which would run a workspace's commands in a container (Roadmap and vision).
• Plugins run with the same full access as Delorun. When you install a plugin and each time Delorun starts, it checks that the plugin says it works with your versions. It does not check the plugin's files again after the install: if a plugin you installed from npm, git or a tarball changes on disk, the changed version loads at the next start.

What Delo Run can and cannot doCopy Anchor Link

Delo Run publishes Delorun's releases, this documentation and the waitlist. It publishes no plugin catalogue and no list of revoked plugins (Roadmap and vision).

Delo Run can:

• publish a release. Your installation installs it only when you confirm an update, and never goes back to an older release on its own;
• sign each release and record it in a public log, so anyone can check that every installation got the same release.

Delo Run cannot:

• reach your studio. Remote access over Tailscale uses nothing of Delo Run's, and Delo Run holds none of your studio's keys or your devices' keys;
• approve a device for you, send commands to your computer, or change the plugins you have installed;
• turn off or revoke a plugin you installed;
• vouch for plugins: it does not review them.

What you still trust:

• Delo Run's releases and the delorun.com addresses that serve them;
• each plugin you install, and the place you installed it from;
• DeepSeek Harness's code, which Delorun runs at a named release.

What each reach option shows its providerCopy Anchor Link

Reach means opening your studio from another device, such as your phone. It is off until you turn it on, and it uses nothing of Delo Run's. Delorun offers one option: Tailscale on your own tailnet (Reach the studio from your phone). delorun reach on tailscale refuses while Tailscale Funnel, which would publish your address on the internet, is on.

The table also describes two options that Delorun does not offer, so you can compare (Roadmap and vision).

Whatever the option, a device opens your chats only after you approve it at your computer. Delorun offers no sign-in with a passkey or your own sign-in provider either.

Edge cases

• If Tailscale Funnel is on, then delorun reach on tailscale refuses — turn Funnel off with the command it prints, then run it again.
• If Funnel is turned on while reach is running, then Delorun notices within a minute and stops serving the address — turn Funnel off with the command that delorun reach on tailscale prints when it refuses.

What leaves your machineCopy Anchor Link

By defaultCopy Anchor Link

Two checks run by default. They carry nothing about you, but each server they reach sees your IP address and the time of the request.

• The release-log check, at each start. It asks Sigstore's public release log, and the service that publishes its state, whether the release you run is the one Delo Run recorded publicly. No setting turns it off. When the log cannot be reached, Delorun starts anyway and warns you.
• The update check, once a day. It fetches Delorun's signed release files from releases.delorun.com, or from a fallback host, to see whether a newer release exists (Updates). Turn it off in Settings, General, Updates, or with delorun setup privacy.

Each file these checks download is checked against its signature, so a server that hands out a changed file fails the check. Delorun downloads no list of revoked plugins, because Delo Run publishes none.

Only when you opt inCopy Anchor Link

delorun setup --yes and --config never turn on reach or DeepSeek's session-log upload.

• DeepSeek's session-log upload is off until you turn it on in Settings, Safety, Privacy. When it is on, each request to DeepSeek's official API also carries the part of your chat's log not sent yet: your messages, the replies, tool calls with their results, workspace paths and feedback.
• Desktop analytics belong to DeepSeek Harness's desktop app. The profile delorun runs collects none, and Settings, Privacy says so.
• Feedback. The profile delorun runs has no feedback dialog, so it sends no feedback.
• Model requests go to the model provider you set up, and carry what the model receives for each turn.
• Reach sends traffic through the provider you choose, as the table above says.

Edge cases

• If the release log cannot be reached, then Delorun starts and shows a warning — nothing to fix; it checks again at the next start.
• If you turned the update check off, then you hear of new releases only when you run delorun update — run it now and then.

Checking it yourselfCopy Anchor Link

• delorun verify checks that the installed release is signed, that it is in the public release log, and that its files are the signed ones. It does not check isolation, exposure, sign-in, plugins or data sharing: the report lists each as not run and ends with this is not a full verification of this Delorun. The checks run as you, so a program running as you could tamper with them.
• delorun logs shows each log, where it is and what it holds (Where Delorun keeps its logs).

Go further

• Check the launcher. npm serves the delorun launcher before any Delorun check runs, so check it separately. delorun verify prints a Launcher line with the integrity that the installed release's signed manifest gives the launcher you ran. Compare it with the output of npm view delorun@<version> dist.integrity.
• Compare the release roots. Delo Run publishes the SHA-256 of each release root file and its key ids in the README, on this page, in each release's notes and in delorun/release/production-keys.json. Compare them with the root files under the launcher package's roots/ directory.
• Setup installs the delorun command at the version you ran, never the newest version npm serves.

Reporting a problemCopy Anchor Link

Report a suspected vulnerability privately, as SECURITY.md describes, and not in a public issue. Report other problems to support@delorun.com.

Next. To see the protections themselves, read What Delorun protects. To reach your studio from your phone, read Reach the studio from your phone. If something went wrong, find its message in Troubleshooting.

For the technically curiousCopy Anchor Link

The delorun/docs/security/threat-model.md lists every boundary, its defence and what Delorun does not protect against. The delorun/docs/contracts/c15-verification-checks.md defines each delorun verify check, and the delorun/docs/contracts/c07-reach-providers.md defines what each reach option may use.