Security and privacy

Coduva is a development tool, designed to run only on this computer. This page explains which protections exist and what you should pay attention to.

Network access

All services listen only on the 127.0.0.1 (loopback) address:

Service	Address it listens on
Nginx	127.0.0.1:80, and 127.0.0.1:443 if HTTPS is on
PHP FastCGI pools	127.0.0.1:9800–9999
MariaDB	127.0.0.1:3306 (bind-address=127.0.0.1)

Another computer, phone, or virtual machine on the local network cannot connect to these services. Exposing sites to the network is deliberately left as a separate, opt-in choice, and it is not available in version 0.2.0.

The MariaDB root user has an empty password and is reachable only from this computer. phpMyAdmin logs in automatically as this user, and it opens only through 127.0.0.1.

Permission model

• The main application runs without elevated permissions. You do not need to run Coduva as an administrator, and it is not recommended. The installer is per-user.
• The hosts file is protected by Windows. When a change is needed, Coduva runs itself with the --coduva-hosts-helper argument, elevated through the Windows UAC approval prompt. The helper does its job and exits.
• If the requested content is identical to the file's current content, no UAC approval is requested.

Limits of the hosts helper

The helper process changes only Coduva's marked section and does not touch lines outside that section:

# >>> Coduva — bu bölüm Coduva tarafından yönetilir
127.0.0.1 magaza.test
127.0.0.1 panel.test
# <<< Coduva

Before writing the list it was given, the helper validates it again, and it accepts only lines in the form 127.0.0.1 <name>.test. Even if the list file is changed by another program, no other address or domain name is written to the hosts file.

Local certificate authority

For local HTTPS, Coduva generates a certificate authority (CA) specific to this computer.

Property	Value
Name	Coduva Local CA (<computer name>)
Key	ECDSA
Validity	10 years
Location	C:\Coduva\etc\ssl\ca\coduva-ca.crt and coduva-ca.key
Trust store	The Windows user root certificate store (certutil -user)
Project certificates	Issued for <name>.test, signed by the CA, valid for 825 days; stored in C:\Coduva\etc\ssl\sites\

The CA is added to the Windows user store with Trust on the Local HTTPS screen. No administrator permission is required; Windows shows a security confirmation window. Chrome and Edge use this store. Firefox may require about:config → security.enterprise_roots.enabled = true.

Protect the CA key

Anyone who has the coduva-ca.key file can create certificates that the browsers of this Windows user will trust. Therefore:

• Do not share the C:\Coduva\etc\ssl\ca folder, do not add it to a repository, and do not give it to anyone else, including as part of backups.
• When you are not using local HTTPS, remove the CA from the trusted list with Remove trust on the Local HTTPS screen.
• After you uninstall Coduva, make sure the CA is also removed from the user store (certmgr.msc → Trusted Root Certification Authorities).

The CA is not regenerated once it exists; turning HTTPS on and off in projects affects only the project certificate.

Protecting secrets

• Passwords are not written to the settings database. Project records do not store database passwords.
• The WordPress admin password is shown only once, at the end of the setup; Coduva does not store it.
• Event log and service logs: In the details written to the log, the values of the password, passwd, pwd, secret, token, api_key, and apikey keys are masked.
• Health report: Lines taken from logs are masked in the same way before they are written to the report.

One-click WordPress login

Log in as admin works as follows:

1. Coduva writes a small plugin to wp-content\mu-plugins\coduva-login.php in the project, and writes a random 48-character token to wp-content\coduva-login.token.
2. The wp-login.php?coduva_login=<token> address is opened in the browser.
3. The plugin reads the token file and deletes it immediately. If the token is older than 2 minutes or does not match, the login is not performed.
4. If it matches, the session is opened with the first administrator account on the site, and you are redirected to the admin dashboard.

The token can be used only once. This plugin is intended for local development; when you move the site to a live server, do not include the coduva-login.php file.

Web server protections

• Access through Nginx to dot-prefixed files and folders (such as .env, .git, and .htaccess) is blocked, except for .well-known.
• The server version is not shown in responses (server_tokens off).
• Project virtual hosts serve only their own web roots.

Download verification

• Components are downloaded only from their official sources, and only over HTTPS.
• Each package is verified against the SHA-256 value in the notice that ships with Coduva; if it does not match, the package is deleted.
• When zip packages are extracted, paths that would leave the target folder are skipped (zip-slip protection).
• The WordPress core is accepted only from downloads.wordpress.org and is verified against the SHA-1 value published by WordPress.org.

Details: Components.

Coduva updates

• Coduva checks for new versions at https://updates.coduva.dev/stable/latest.json; checks and downloads are made only over HTTPS.
• Every installer package is signed with Coduva's signing key. The public key needed for verification is inside the application; a package whose signature does not match is not installed.
• The signature covers the package's version number as well, so an old signed package cannot be presented as a new version.
• Coduva does not install updates on its own. Downloading and installing start only with Install and restart on the Updates card in Settings › Updates.

Details: Keeping Coduva up to date.

Privacy

• No telemetry. Coduva does not send usage data, error reports, or project information.
• No account is required. There is no cloud sync.
• Works offline. After the components are installed, the internet is used only when you download new components, when you create a WordPress or Laravel project, when you run package commands yourself (Composer, npm, WP-CLI), and for the update check.
• The update check runs at most once a day and is a single HTTPS request for latest.json. The address and the request contain no information about your Coduva version, computer, projects, or usage; like any web request, the server sees only your IP address. You can turn it off with the Check for updates automatically switch on the Updates card in Settings › Updates.
• If you use the CodVS editor, CodVS connects to open-vsx.org to install and update extensions. Communication between Coduva and CodVS is not over the network; it takes place through the %APPDATA%\Coduva\editor-bridge.json file and the command line, and this file contains no password. See CodVS editor.
• Your data stays on your computer. Projects, databases, and backups are kept in local folders. See Directories and files.
• External addresses that can be opened from within the application are limited to a fixed list (coduva.dev and Microsoft's Visual C++ download address).

Code signing

In the 0.2.0 closed beta, the installer is not yet code-signed. Windows SmartScreen may show a "Windows protected your PC" warning on first run. If you obtained the installer only from Coduva's official source, you can continue with More info → Run anyway. Code signing will be added before the general release. See Release notes.