Korg Bro is a local desktop client. Its webview can invoke the current Grok ACP proxy, select attachments, preview paths referenced by a session, and open paths. Treat a build the same way you treat grok itself: only run ones you trust.

Authentication stays inside Grok. Korg uses x.ai/auth/* and exposes only { signedIn, email, name } to the UI; it does not read or write auth.json or expose credentials.

Do not file a public GitHub issue for a vulnerability or leaked credentials.

Use GitHub Security Advisories, or message Lynn.