Security Considerations for Private Deployment Support in Coco AI

Coco AI enables organizations to maintain complete data sovereignty by allowing the desktop client to connect exclusively to self-hosted Coco-Server instances, ensuring sensitive data never leaves the trusted network perimeter.

Coco AI, developed by infinilabs, is engineered with private deployment support as a core architectural principle. This design allows enterprises to run the entire stack—both the Tauri-based desktop client and the backend server—within their own infrastructure. By analyzing the source code, we can identify the specific security mechanisms that enforce data isolation, prevent unauthorized network egress, and protect authentication credentials in private deployment scenarios.

Data Sovereignty and Server Configuration

The foundation of private deployment support lies in configurable server endpoints that bypass the default cloud service.

Environment-Based Server Targeting

The client reads the target server address from environment variables defined in .env:

# .env

COCO_SERVER_URL=https://coco.mycorp.local

This value is consumed by the connection store (src/stores/connectStore.ts) during initialization. By pointing COCO_SERVER_URL to an internal domain, all API requests—including document indexing, search queries, and chat completions—route through your infrastructure rather than the default https://coco.infini.cloud/ endpoint.

Explicit Privacy Messaging

The UI communicates the security benefits of private servers through localized strings in src/locales/en/translation.json:

"Running your own private instance of coco-server ensures complete control over your data…"

This transparency ensures end-users understand that selecting a private server eliminates data exfiltration risks associated with SaaS deployments.

Runtime Security Hardening

The Tauri runtime configuration implements defense-in-depth measures to prevent code injection and unauthorized resource loading when operating in private environments.

Content Security Policy (CSP) Enforcement

The tauri.conf.json defines a strict CSP that restricts the webview to trusted origins:

{
  "security": {
    "csp": "default-src 'self'; connect-src 'self' http: https:; script-src 'self'; style-src 'self' 'unsafe-inline'"
  }
}

This policy prevents the application from loading remote scripts or connecting to arbitrary domains, mitigating XSS and supply-chain attacks even if an attacker compromises the private server’s responses.

Asset Protocol Isolation

The configuration explicitly enables the asset: protocol while disabling dangerous modifications:

{
  "security": {
    "assetProtocol": {
      "enable": true,
      "scope": ["$RESOURCE/**"],
      "dangerousDisableAssetCspModification": false
    }
  }
}

This ensures the UI can only load resources bundled with the application. External content must pass CSP validation, preventing local file inclusion vulnerabilities.

Server Selection and Validation Logic

The client implements strict filtering to prevent accidental connections to untrusted endpoints.

Enabled Server Filtering

The utility function getEnabledServers in src/utils/servers.ts filters the server list before any network connection occurs:

import { getEnabledServers } from '@/utils/servers';
import { useConnectStore } from '@/stores/connectStore';

const safeServers = getEnabledServers(useConnectStore.getState().serverList);
// Returns only servers where enabled === true && available === true

This prevents the UI from attempting connections to disabled or unreachable endpoints, reducing the attack surface for DNS hijacking or rogue server injection.

Secure Token Management

Authentication tokens are handled separately from server metadata in src/stores/authStore.ts. The store maintains tokens in memory only, persisting them via secure OS-specific mechanisms rather than plain text:

• Tokens are transmitted via Authorization headers
• No hard-coded secrets exist in the repository
• Credentials are cleared from memory on logout

This architecture ensures that even if an attacker gains access to the client filesystem, they cannot extract long-lived credentials for the private server.

Deployment Configuration Examples

Configuring a Private Server Endpoint

To direct the Coco AI client to your internal infrastructure:

1. Clone the repository and create a local environment file:

cp .env.example .env

2. Edit .env to point to your private server:

COCO_SERVER_URL=https://coco-server.internal.company.com
VITE_COCO_SERVER_URL=https://coco-server.internal.company.com

3. Build the Tauri application:

npm install
npm run tauri build

The resulting binary will connect exclusively to your specified private server, ensuring all indexed documents and chat histories remain within your network perimeter.

Validating CSP at Runtime

To verify that the security policies are active in your private deployment:

import { invoke } from '@tauri-apps/api/tauri';

// Query the effective CSP
invoke<string>('plugin:security|get_csp').then(csp => {
  console.assert(
    csp.includes("'self'"),
    'CSP must restrict to self origin'
  );
});

This validation ensures that even in custom builds, the Content Security Policy remains intact to prevent data exfiltration via malicious scripts.

Summary

Coco AI’s private deployment support provides a defense-in-depth architecture for organizations requiring strict data sovereignty:

• Configurable endpoints via .env allow complete routing control to self-hosted servers
• Strict CSP and asset protocols in tauri.conf.json prevent code injection and unauthorized network requests
• Server validation logic in src/utils/servers.ts filters connections to only enabled, available endpoints
• Secure token isolation in src/stores/authStore.ts ensures credentials remain in memory and are never hard-coded
• Transparent privacy messaging in translation files educates users about data control benefits

These mechanisms collectively ensure that when deployed privately, Coco AI operates as an isolated, auditable system with no telemetry or external data leakage.

Frequently Asked Questions

How does Coco AI ensure data never leaves my network in a private deployment?

Coco AI enforces data sovereignty through configurable server endpoints and strict runtime policies. By setting COCO_SERVER_URL in the .env file to your internal domain (e.g., https://coco-server.internal.company.com), all API requests—including document indexing and chat completions—route exclusively through your infrastructure. The Tauri Content Security Policy further prevents the application from loading external resources or sending data to unauthorized domains.

What security mechanisms prevent malicious scripts from running in the Coco AI desktop client?

The application implements a multi-layered defense through Tauri’s security configuration in src-tauri/tauri.conf.json. The Content Security Policy restricts script execution to 'self' and explicitly blocks inline scripts and remote code loading. Additionally, the assetProtocol configuration isolates application resources, allowing the UI to load only bundled assets while requiring external content to pass CSP validation. These measures prevent XSS attacks and supply-chain compromises even if a private server is compromised.

Where does Coco AI store authentication tokens, and are they secure in a private deployment?

Authentication tokens are managed by src/stores/authStore.ts and stored only in client-side memory, never written to persistent storage in plain text. The store transmits tokens via Authorization headers to the configured private server, and clears them from memory upon logout. This architecture ensures that even with physical access to the client machine, an attacker cannot extract long-lived credentials for your private Coco-Server instance.

Can I disable automatic updates to prevent external network calls in a private deployment?

While the Tauri configuration includes bundle.createUpdaterArtifacts: true, the updater is hard-coded to contact only release.infinilabs.com and respects the system proxy settings. For air-gapped or strictly isolated deployments, you can build the application with TAURI_SKIP_UPDATE_CHECK=1 or modify src-tauri/tauri.conf.json to disable the updater endpoint. This ensures the client makes no external network requests beyond your specified private server URL.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}