Knobs in the UI, paths on disk. Nothing here leaves the machine that runs the app.
| What | Where |
|---|---|
| Roots, pins, notes, hide, open commands | $XDG_CONFIG_HOME/workspace-welcome/store.json |
| Report HTML cache | $XDG_CACHE_HOME/workspace-welcome/reports/ |
| code-server install | $XDG_DATA_HOME/workspace-welcome/ide/ |
On most Linux boxes that is under ~/.config, ~/.cache, and ~/.local/share. Store writes are atomic.
The app is fine on localhost or a trusted LAN. The IDE runs with --auth none. File routes reject path escapes. Still: do not hang this on the public internet and walk away. It is a tool for your network, not a fortress.