Skip to main content
Anaconda Desktop is designed with security in mind. Use the resources below to report vulnerabilities and learn about Desktop’s default security model.

​
Reporting security issues

If you discover a security vulnerability in Anaconda Desktop, report it through Anaconda’s Vulnerability Disclosure Program on Intigriti.

​
Security model

The following describes Desktop’s default security model:
  • Least privilege: Desktop follows the principle of least privilege, which means it only uses the permissions required for normal operation. All processes run under your standard user account without requesting administrator or root access, limiting the potential impact if any component is compromised.
  • Encrypted credentials: OAuth tokens are stored using OS-native encrypted secure storage.
  • Session security: Signing out clears all session tokens from memory.
  • Data privacy: App usage and performance data is anonymized.
    To disable telemetry entirely, go to Settings and turn off App Settings.
  • Network isolation: The Desktop API server binds to 127.0.0.1 by default and requires authentication. This means the API is only reachable from processes on your own machine and is never exposed to a local network or the internet.