Security & privacy
It reads a lot about your computer. None of it leaves unless you say so.
Warden looks at your event log, your device inventory, your network configuration and your installed services. That is a great deal of trust to ask for, so here is exactly what happens to it, including the one case where some of it is sent somewhere.
Nothing is transmitted unless you turn on the cloud model
No account
There is no sign-up, no licence key and no activation. Nothing identifies you because nothing needs to.
No telemetry
No usage analytics, no crash reporting, no 'anonymous' statistics. There is no code in the project that sends anything outward.
No key ships with it
The repository is public and contains no credentials, and never will, because a key in a public repository is a key for everybody. If you add your own it stays in your user folder and no endpoint returns it.
Loopback only
Warden's internal server binds to 127.0.0.1. It is not reachable from your network, let alone the internet, even while it is running.
The default model is local because it has to be
Warden reasons with a language model that runs on your processor. That is a functional requirement before it is a privacy one: a diagnostician that needs the internet to explain why you have no internet is not a diagnostician. The privacy consequence, that your machine’s configuration never leaves it, comes free with getting the engineering right.
That argument is why the local model cannot be removed and why the cloud one cannot be required. It is not a reason to pretend the cloud option does not exist, so the next section says exactly what it does.
The one thing that does send data, and only if you switch it on
Seventeen reviewed actions cannot repair an arbitrary Windows fault. The cloud model is how Warden reaches past them, and it costs something real.
Cloud mode is off on every install. Turning it on requires a Groq API key you fetch yourself, pasted into the Model page inside the app. Warden does not ship a key, does not proxy through a server of ours, and there is no server of ours.
What is sent, when it answers: the symptom, the readings the collectors took that are relevant to it, your Windows version and architecture, and the list of actions it may choose from.
What is never sent: your files, your browsing, your account names, your product key, anything typed into any other application, and anything Warden has not itself measured.
With cloud mode on, the model is allowed to write a command rather than pick one from the seventeen. Those are labelled as written-by-the-model everywhere they appear, are checked against a refusal list before you are shown them, still run as an argument list with no shell, and still take a restore point first. It is a weaker guarantee than the reviewed list makes, and the app says so on the card rather than in a footnote.
Your key is written to %LOCALAPPDATA%\Warden\credentials.json, in its own file rather than with your settings, because the settings endpoint returns everything in it. No endpoint returns the key. The app shows you four characters of it. Removing it deletes the file.
What it is capable of doing
The honest way to describe the risk of a tool like this is not 'it is safe', but 'here is the complete set of things it can do'.
Warden can run seventeen reviewed commands. Not seventeen kinds of command: seventeen specific ones, written by hand, sitting in the source where you can read them before you install anything. The AI selects from that list; it cannot compose, extend or edit it.
Commands are passed to Windows as separate arguments rather than a line of text given to a shell. There is no shell anywhere in the execution path, so there is nothing for a crafted network name or device path to inject into.
Nothing runs without you pressing a button. Not on a timer, not as a default, not in the background, and not in bulk. There is no “fix everything”.
If something goes wrong anyway
A restore point before anything disruptive
Before the first disruptive action of a session, Warden asks Windows for a System Restore checkpoint. If System Protection is switched off it says so rather than pretending a safety net exists.
Warden does not roll your machine back itself
It opens Windows' own restore screen. Undoing system state reverts changes Warden never made and cannot verify, and doing that silently from inside the tool you already suspect would be the wrong instinct.
Everything it did is written down
Each run records what was read, what was concluded, what you approved and whether it worked, including the times it did not. It is a file on your disk, in a format you can read.
Verify any of this
None of the above should be taken on trust, which is why the whole thing is open. The claim “it sends nothing” is checkable in an afternoon: there is one HTTP client in the project and it points at 127.0.0.1.
Reporting a problem
If you find a security issue, please open an issue on GitHub. This is a student project without a formal disclosure process, but a real problem will be taken seriously and fixed in the open.