Security

A summary of the security model and how to verify or report against it. The full policy is SECURITY.md in the source repository, which is private during the beta.

Local-first daemon authority

The local daemon (apps/daemon-v2) is the sole authority over identity keys, secrets, and side effects. The browser UI, the IDE bridge, and any connected editor only ever talk to it — none of them holds a signing key or executes anything themselves. On iOS the same daemon runs embedded, statically linked into the app.

Capability and consent gating

Anything the daemon executes on your behalf is capability-scoped — an agent declares what it can read or write, and the daemon records and checks those declarations rather than trusting the agent at run time. Where an action has real-world consequences, it is additionally consent-gated: approved explicitly by you, not inferred from a prior grant.

How far this goes today: the declaration, admission and consent path is implemented and tested, and enforcement of individual capability classes is still being extended. Nothing here has had an outside security review. Treat it as a design under construction, not a guarantee.

Signed releases

There is no public release yet, so no binaries have been published and none of the evidence below exists to check. This is the policy a release must meet before it ships, and the commands people will use once it does. The attestation command needs the source repository to be public, which it is not during the beta.

A published release binary must carry three independent pieces of evidence: a SHA256SUMS manifest, a GitHub build-provenance attestation (SLSA v1, recorded on the public Rekor transparency log), and a detached keyless cosign signature. Verify either way:

# Via GitHub's attestation store
gh attestation verify <file> -R jackdonahoo/Agent-Web

# Via cosign directly against the published .sig/.pem
cosign verify-blob \
  --certificate <file>.pem \
  --signature <file>.sig \
  --certificate-identity-regexp 'https://github.com/jackdonahoo/Agent-Web/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  <file>

The release workflow rejects the daemon, service binaries, and prebuilt CLI toolchain archives unless they pass this pipeline (docs/supply-chain.md in the source repository). See Download for what's published for a given release.

Reporting a vulnerability

Do not open a public issue. The repository is private during the beta, so GitHub Private Vulnerability Reporting on it is open only to invited collaborators. A dedicated security@agentwebbrowser.co mailbox is planned pending launch. There is no public reporting channel during the private beta; one will be published here before any public release.

In scope:

apps/daemon-v2 — keystore/HSM boundary, MLS session layer, capability-scoped IPC, DID resolver, payment/escrow rail.
apps/browser — the desktop shell and its frontend, including the daemon IPC client.
apps/daemon-ffi — the mobile embedding of the daemon.
services/* — the gateway and supporting services.
contracts/ — the on-chain smart-contract system.

Once a reporting channel exists, the intent is to acknowledge reports within 5 business days, with a 90-day coordinated-disclosure window. There is no channel during the private beta, so that is a commitment for the public release, not a service running today. Full scope, safe-harbor terms, and the bug-bounty program status are in SECURITY.md in the source repository.