Code signing policy
necoder is a free, open-source code editor (AGPL-3.0). This page covers the Windows builds.
Free code signing provided by SignPath.io, certificate by SignPath Foundation.
What is signed
The Windows installer (necoder-windows-x64-setup.exe) and necoder.exe attached to GitHub Releases. They are built by GitHub Actions from the public source of github.com/iKora128/necoder only. Every signing request is approved by hand. The macOS build is signed and notarized with Apple's Developer ID separately.
Team roles
| Role | Members |
|---|---|
| Committers and reviewers | Daichi Nagashima (@iKora128) |
| Approvers | Daichi Nagashima (@iKora128) |
Contributions from anyone else are merged only after review. All members use multi-factor authentication for GitHub and SignPath.
Privacy policy
necoder has no telemetry, analytics or crash reporting. Crash logs stay on your computer. necoder connects to other systems only in these cases:
| When | Where | Can you turn it off? |
|---|---|---|
| Checking for a new version, every few hours | GitHub (api.github.com) | Yes: Settings → Behavior & editor → “Check for new versions automatically” |
| Refreshing the list of AI agents, at most hourly | ACP registry (cdn.agentclientprotocol.com) | Yes: the same switch |
| You press “Install” for an AI agent | nodejs.org and the npm registry | Only runs when you press it |
| You use an AI agent (Claude Code, Codex and others) | That agent's own service, under its own privacy policy | Agents are off until you turn them on |
| You turn on phone remote control | necoder's relay (control.necoder.com) | Off until you turn it on |
| You open a Git remote, an SSH host or a web page in necoder | The address you chose | Only runs when you ask |
Besides its own folder, the installer adds a Start menu entry and, if you leave them checked in setup, a desktop shortcut, an “Open with necoder” entry in Explorer and an entry in your user PATH. It needs no administrator rights. Uninstall it from Windows Settings → Apps; your settings in %APPDATA%\necoder are kept until you delete them.
日本語
necoder の Windows 用のインストーラと necoder.exe は、SignPath Foundation の証明書で無料で署名しています。署名するのは、公開しているソースから GitHub Actions が作った物だけで、署名のたびに人が承認します。
necoder はテレメトリーや利用状況の送信をしません。自動でネットにつなぐのは、新しいバージョンの確認と AI エージェント一覧の更新だけで、どちらも 設定 → 動作とエディタ の「新しいバージョンを自動で確認」で止められます。そのほかは、インストールを押した時・AI エージェントを使う時・スマホ連携を入れた時など、操作した時だけつなぎます。