Subject: Vigilance on our computers: one host to allow Hi , We are turning on Vigilance at . It checks each new package version that our AI tools and our staff install on our computers. This email lists all it needs from the network and the computers. WHAT TO ALLOW - Outbound HTTPS to check.vigihq.com, TCP port 443. - That is the only Vigilance host. Use the name, not IP addresses. It runs on Amazon CloudFront, so the addresses change. It has IPv4 and IPv6 addresses. - No UDP. No other port. WHAT IT DOES NOT NEED - No proxy setting. - No root certificate. It does not inspect or decrypt traffic. - No kernel driver or system extension. - No admin rights. The program runs as the signed-in user, in the user's home folder. - No inbound port. It listens on 127.0.0.1 only, for npm, pnpm, yarn, bun, pip and uv on the same computer. - No VPN. WHAT STAYS THE SAME - Package files still come from registry.npmjs.org, pypi.org and files.pythonhosted.org, or from our own registry. Keep those open. - If a command names another package server, Vigilance checks that install too, with that server as the source. Nothing is stopped. HOW IT GETS ON THE COMPUTERS Each person opens our join link and runs one installer on their own Mac or Windows computer. It takes about a minute. To push it from your device manager or a script, run the same installer silently with our join code: --join . Use the silent install only on computers that owns. WHAT THE INSTALLER CHANGES ON EACH COMPUTER - One program in the user's home folder (~/.vigi-seat). - Two background items: the program, named Vigilance, which starts at login, and one small watchdog job. - The user-level settings of npm, pnpm, yarn, bun, pip and uv, so installs go through the check. Each file keeps the old value as a comment. - A short note in the instruction file of each AI tool it finds. On a paid plan (Done With You or Done For You) it also adds a hook in each AI tool. - The result screen names each item and each file it changed. If the program stops, installs can fail for about 2 minutes, until the watchdog puts the old settings back. After that, installs go ahead unchecked. We get an email the same day. The readout lists each joined computer by a two-word name, such as "blue otter". OPTIONAL: CLAUDE HARDENING You do not need this. Use it if you manage our computers and want to lock Claude Code settings. Vigilance sends us a ready settings file at setup. Put it in a new file on each computer with your device manager: - macOS: /Library/Application Support/ClaudeCode/managed-settings.d/50-vigilance.json - Windows: C:\Program Files\ClaudeCode\managed-settings.d\50-vigilance.json The file names no Vigilance host other than check.vigihq.com. It holds our company key. The company key unlocks no data. It only sets our mode and ties our monthly counts to our company. We give you the key on a setup call or by a one-time link, never by email. 5-MINUTE CHECKLIST 1. Allow TCP 443 to check.vigihq.com. 2. If your firewall decrypts HTTPS, add check.vigihq.com to the do-not-decrypt list. 3. From any staff computer, run: curl -sS https://check.vigihq.com/v1/ping It prints: {"schema":"vigi.ping/1","ok":true,"service":"check.vigihq.com"} 4. Run the installer on one computer. The result screen says "Vigilance is on" and the network check says PASS. 5. Ask an AI tool to install one package in an empty folder, for example "npm install lodash". It works as before. HOW TO TURN IT OFF We remove a computer on our owner page, or you run this on it: ~/.vigi-seat/Vigilance uninstall It puts back the old package settings, removes the hooks, the notes, both background items and its own files. On Windows it is also in Settings > Apps. If you added the Claude hardening file, remove it too. If the program does not run, the removal pages say how to remove it by hand: https://vigihq.com/setup/remove-mac and https://vigihq.com/setup/remove-windows WHAT LEAVES THE COMPUTER Every field, and how long it is kept: https://vigihq.com/security/data Questions: support@vigihq.com. A person reads it. Thank you,