Important security considerations for CC Mobile Controller.

CC Mobile Controller is designed for personal local use. It connects your phone to your computer via a public tunnel (ngrok), which introduces security considerations.

Phone → ngrok (encrypted) → Bridge Server → Claude Code → Your Files

1. ngrok tunnel — Public URL accessible from internet
2. Bridge Server — Exposed port on your computer
3. AUTH_TOKEN — Single point of authentication
4. Claude Code — Access to your workspace files

All connections require a valid AUTH_TOKEN.

Requirements:

• Minimum 32 characters
• Stored in .env (never commit to git)
• Transmitted via HTTPS (ngrok provides TLS)

Generate a strong token:

# Linux/macOS
openssl rand -hex 32

# Or use any 32+ character random string

ngrok provides:

• ✅ HTTPS encryption
• ✅ Public URL with random subdomain
• ⚠️ URL changes on restart (free tier)

Recommendations:

• Use ngrok only when needed
• Stop ngrok when not in use
• Consider paid plan for fixed URL

Bridge Server binds to 0.0.0.0:3000 by default.

For local-only access (no ngrok):

• Configure Mini Program to use local IP
• Only works on same WiFi network
• No internet access required

Before using CC Mobile Controller:

• AUTH_TOKEN is at least 32 characters
• .env is in .gitignore
• .env is not committed to git
• ngrok is stopped when not in use
• You understand Claude Code has file access

Scenario: Someone guesses or intercepts your AUTH_TOKEN.

Mitigation:

• Use a strong, random token
• Change token periodically
• Stop ngrok when not in use

Scenario: Claude Code can read/write files in your workspace.

Mitigation:

• Configure workspace paths carefully
• Don't include sensitive files in workspace
• Review Claude Code's actions

Scenario: ngrok URL is discovered by others.

Mitigation:

• ngrok URLs are random and hard to guess
• AUTH_TOKEN provides second layer of protection
• Stop ngrok when not in use

1. Use strong tokens — At least 32 random characters
2. Limit workspace scope — Only include necessary directories
3. Stop when not in use — Don't leave ngrok running 24/7
4. Monitor logs — Check Bridge Server logs for suspicious activity
5. Keep updated — Update dependencies regularly

• ❌ Commit .env to git
• ❌ Share your AUTH_TOKEN
• ❌ Expose Bridge Server directly to internet (without ngrok)
• ❌ Include sensitive files in workspace
• ❌ Leave ngrok running unattended

If you discover a security vulnerability, please:

1. Do NOT open a public issue
2. Email the maintainer directly
3. Provide details of the vulnerability

Security Guide — CC Mobile Controller