web-edit keeps credentials out of the agent conversation

Simon Willison released web-edit 0.1a0 after he needed to change a credentials file while working from his phone through Codex Remote. He did not want the sensitive contents to make a round trip through the LLM conversation.

The sensitive file gets a route outside the prompt

web-edit is a Python application with a web interface for browsing and editing files in a folder. Willison had Codex and GPT-6 Astra Extra High build it. The intended setup runs over Tailscale: an agent starts the application on the remote machine and the human connects directly from a phone.

The interface can browse, upload, delete and edit files. Images smaller than 2 MB appear inline in the demonstrated interface. Editing uses CodeMirror 6 because, in Willison's assessment, Monaco still does not offer a sufficiently good mobile experience.

A separate channel gives the human custody of secrets

The editor itself is not the interesting part. The separation of roles is. An agent can work on the project while the human keeps a narrow side channel for changing a file that should not be pasted into a prompt. The pattern applies to credentials, configuration values and other data the model does not need for the task.

For developers working from a phone, this creates a layer between a terminal and an agent. Instead of a full remote editor, they get a small interface for one job. A smaller surface is useful here, provided it actually stays small.

Security still depends on the network, process and directory boundary

Version 0.1a0 is an early release, and the short announcement does not describe a security audit, session management or abuse protections. Tailscale restricts who can reach the application, but it cannot fix a bug in the editor or an overly broad view of the filesystem.

The tool therefore makes sense as a private utility behind a trusted network, not as an editor exposed to the public internet. Its safety also depends on which directory the process can see and which account runs it.

Permissions and failure behavior will decide whether the pattern travels

Future releases can show whether web-edit gains authentication, finer permissions, a change log and safe handling of concurrent writes. Symlinks, large files and interrupted saves are equally concrete tests.

The most valuable signal is already visible: an agent does not need to see every byte a person touches. A good agent workflow is partly defined by the data the model never receives.

Lilith's verdict

web-edit's best security feature is the blank space in the chat: the password stays in the file while the agent walks past without looking inside.