Security

A summary of the security model and how to verify or report against it. Full policy: SECURITY.md.

Local-first daemon authority

The local daemon (apps/daemon-v2) is the sole authority over identity keys, secrets, and side effects. The browser UI, the IDE bridge, and any connected editor only ever talk to it — none of them holds a signing key or executes anything themselves. On iOS the same daemon runs embedded, statically linked into the app.

Capability and consent gating

Anything the daemon executes on your behalf is capability-scoped — an agent declares what it can read or write, and the daemon enforces that boundary rather than trusting the agent's own claim. Where an action has real-world consequences, it is additionally consent-gated: approved explicitly by you, not inferred from a prior grant.

Signed releases

Published release binaries are required to carry three independent pieces of evidence: a SHA256SUMS manifest, a GitHub build-provenance attestation (SLSA v1, recorded on the public Rekor transparency log), and a detached keyless cosign signature. Verify either way:

# Via GitHub's attestation store
gh attestation verify <file> -R jackdonahoo/Agent-Web

# Via cosign directly against the published .sig/.pem
cosign verify-blob \
  --certificate <file>.pem \
  --signature <file>.sig \
  --certificate-identity-regexp 'https://github.com/jackdonahoo/Agent-Web/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  <file>

The release workflow rejects the daemon, service binaries, and prebuilt CLI toolchain archives unless they pass this pipeline (docs/supply-chain.md). See Download for what's published for a given release.

Reporting a vulnerability

Do not open a public issue. Report privately through GitHub Private Vulnerability Reporting on this repository: the Security tab → Report a vulnerability (github.com/jackdonahoo/Agent-Web/security/advisories/new). A dedicated security@agentwebbrowser.co mailbox is planned pending launch; until it is published here, GitHub Private Vulnerability Reporting is the authoritative channel.

In scope:

apps/daemon-v2 — keystore/HSM boundary, MLS session layer, capability-scoped IPC, DID resolver, payment/escrow rail.
apps/browser — the desktop shell and its frontend, including the daemon IPC client.
apps/daemon-ffi — the mobile embedding of the daemon.
services/* — the gateway and supporting services.
contracts/ — the on-chain smart-contract system.

We acknowledge reports within 5 business days and commit to a 90-day coordinated-disclosure window. Full scope, safe-harbor terms, and the bug-bounty program status are in SECURITY.md.