JackIT and security
Information for administrators reviewing the Jack desktop app (Jack for Work). Reviewed against desktop 1.0.0-alpha.20.
Publisher
Jack is published by Barreto Tech, the commercial name of Dasolve AS (organisation number 936 035 019), Norway. The app’s publisher metadata uses Barreto Tech.
Distribution and signing
Windows x64: an unsigned NSIS installer, installed per user in %LOCALAPPDATA%\Programs\<product name>. The current alpha uses Jack Alpha; beta uses Jack Beta and stable uses Jack. The download page links the alpha installer.
macOS Apple silicon: an alpha DMG. The app has ad-hoc signing, but no Apple Developer ID signature or notarization. Gatekeeper may block the first launch; see the macOS installation guide.
Linux x64: an AppImage and a .deb package for Ubuntu and Debian. The .deb is a system package; installing it uses the distribution’s package manager and administrator privileges.
Desktop downloads: SHA-256
These checksums describe the fixed 1.0.0-alpha.20 files linked below, not the changing alpha download aliases.
- Jack-Alpha-Setup-1.0.0-alpha.20.exe
bc4e56b3797002282223a6a6b7cbbc139c83c68044d4156c1b85122f8462803d - Jack-Alpha-1.0.0-alpha.20-arm64.dmg
d22a9b481962b1bcd513857cd3d6065ee80704bc4fcc47084ce2abe23498de14 - Jack-Alpha-1.0.0-alpha.20.AppImage
10406ff31cc3c5cfc1ebcf40b7d8f3e20dc95c690812c4a6bb24bee4aaa8cbc6 - desktop_1.0.0-alpha.20_amd64.deb
91f69770fc6a0ad82e1f9bf87eec1aaf4858c6e6bee4c2398c70393e93047412
What runs on the machine
The Electron desktop app starts its bundled jack Runtime daemon. Closing the window keeps them running in the tray or menu bar. Quit stops the app’s Runtime and its child processes. Start at login is off by default and can be enabled in Settings.
The Runtime and cua-driver are bundled in resources/bin. The cua-driver helper runs in user mode for computer interaction over stdio; it is not a kernel driver and has no separate installer, autostart, scheduled task or elevation step.
App data is separate for each channel: %APPDATA%\<product name> on Windows, ~/Library/Application Support/<product name> on macOS, and $XDG_CONFIG_HOME/<product name> (normally ~/.config/<product name>) on Linux. The app’s Runtime data and runtime.toml are in its runtime subfolder.
Jack starts the selected engine CLI on the user’s behalf: Claude Code, Codex, Copilot, Cursor or OpenCode. Installing an engine tries winget where available on Windows, then a vendor script saved to the app’s temporary data folder and run under the machine’s policy, then the vendor’s installation page. The saved script is deleted after execution.
Engine configuration hooks call the bundled jack hook command to enforce hard limits and request approval for protected actions. Return links use jack:// for stable, jack-alpha:// for alpha and jack-beta:// for beta.
By default, the Runtime listens on 127.0.0.1 on an OS-assigned port, protected by a local token. A separate 127.0.0.1 callback listens during desktop sign-in and closes after at most ten minutes. Runtime configuration can explicitly change its listen address and port; the defaults require no inbound firewall rule.
Network allow-list
These destinations use outbound TCP 443, initiated by the desktop app or its internal bundled Runtime. The relay uses a long-lived WebSocket. Engine providers and integrations can need additional destinations.
| Host | Purpose | Protocol / port | Direction | Process |
|---|---|---|---|---|
| api.jackforwork.com | Account, plan and billing API | HTTPS / 443 | Outbound | Desktop app |
| auth.jackforwork.com | Sign-in and token refresh | HTTPS / 443 | Outbound | Desktop app, Bundled Runtime |
| relay.jackforwork.com | Remote access through the app’s bundled Runtime; relay API | HTTPS / WSS / 443 | Outbound | Desktop app, Bundled Runtime |
| dl.jackforwork.com | Desktop downloads and update feeds | HTTPS / 443 | Outbound | Desktop app |
| jackforwork.com | Website, version and telemetry settings | HTTPS / 443 | Outbound | Desktop app |
| getjack.dev | Telemetry settings for the bundled Runtime (/version.json) | HTTPS / 443 | Outbound | Bundled Runtime |
| s.jackforwork.com | Sentry crash reports and user-submitted problem reports (/tunnel, /minidump) | HTTPS / 443 | Outbound | Desktop app, Bundled Runtime |
| n.jackforwork.com | PostHog usage telemetry proxy | HTTPS / 443 | Outbound | Desktop app, Bundled Runtime |
Engine traffic follows the selected provider and model. Review the vendor’s own network guidance and the integrations your organisation enables.
TLS inspection and proxies
The desktop app’s network requests use Electron’s system certificate store and system proxy. Before starting the Runtime, the app resolves the relay proxy using system settings, including PAC, and writes it to the app’s runtime.toml.
The compiled Runtime trusts the OS certificate store alongside Bun’s roots. It supports [network] proxy in runtime.toml, HTTPS_PROXY, HTTP_PROXY and NO_PROXY (also lowercase). Configuration takes precedence over environment proxy settings; loopback bypasses the proxy.
Allow WebSocket upgrades to relay.jackforwork.com. If inspection prevents the connection, review a host-specific inspection exception with your network administrator. A network’s URL or DNS filtering may also block a host; contact us with the hostname and the filter’s result.
Microsoft work-account sign-in
Jack offers Microsoft, GitHub and Google sign-in through auth.jackforwork.com. If your organisation requires Microsoft administrator approval, ask your Entra administrator to review Jack. Contact us to confirm the current application ID and permissions before granting tenant-wide consent. Another sign-in provider can be used if company policy allows.
Data and telemetry
The selected engine sends the work it processes to its provider. Remote access carries requests and results through Jack’s relay. Review the providers and integrations your organisation enables.
Product usage telemetry operates under legitimate interest. The desktop app’s Electron/main usage pipeline is enabled after verified sign-in on Free, Pro and Team. Its bundled Runtime sends usage telemetry by default and can send before sign-in. Usage events and crash reports have separate, documented data fields. User-submitted problem reports can include diagnostics. Read the privacy policy and telemetry catalogue before approving deployment.
Outside Enterprise, object to product telemetry by email to [email protected]. Website analytics are separate: without consent they are cookieless; storage, session recordings and experiments require Accept.
Security reports and support
For a vulnerability, installation block or suspected false positive, email us with the affected version, OS, hostname and the security product’s message. Remove credentials and confidential content. We can help identify the installer and processes for your review.