toolhive-studio

The application uses hardcoded encryption keys ('toolhive-threads-encryption-key', 'toolhive-chat-encryption-key') for Electron Store, including for API keys and chat history. While this provides basic obfuscation, it offers no real security against a determined attacker who can access the application's code. Sensitive data stored with these keys should not be considered truly secure. The application properly uses `contextBridge` for secure IPC and implements a strong Content Security Policy (CSP). Executing external binaries (`thv`, `docker`, `podman`) is inherent to its functionality and appears controlled, but is always a potential attack surface if user input is not rigorously sanitized.