[TimeToBuildBob]

Problem

ActivityWatch/activitywatch#75 describes two separate failures: shared loopback ports can send a user to another account’s instance, and unauthenticated local APIs expose data across accounts. The existing authentication section does not explain how to combine distinct ports, client configuration and per-user keys.

Change

Add a bounded manual-setup section to the security guide:

• distinct unused ports plus matching aw-client configuration;
• unique opt-in Rust-server API keys and protected config/data permissions;
• explicit Python-server, watcher/extension and dashboard-token limitations;
• a verification checklist that distinguishes the public info endpoint from protected data.

This does not implement automatic port discovery, Unix sockets, native messaging, cross-user ACL enforcement or launcher fixes. It does not close ActivityWatch/activitywatch#75.

Verification

• Two concurrent isolated instances of the published Linux v0.14.1 aw-server-rust binary, with synthetic HOME/XDG roots and databases: each returns 401 for no key or the other instance’s key, 200 with its own key, and lists only its own synthetic bucket. Public info remains 200. Both processes stopped afterward; no production endpoints touched.
• This exercises two isolated configurations under one OS account, not native cross-user permissions or Windows/macOS login behavior.
• Sphinx HTML build succeeds. The unchanged baseline and this branch both report 206 existing warnings; no security.rst warning.
• Strict standalone reStructuredText parse of the added section and git diff --check pass.

Source checks: current aw-qt master already reads configured server ports; current aw-client master discovers the local Rust-server key only on matching loopback host/port. Installed client versions still need individual verification.