​

Security

[!WARNING] Fased assumes one trusted operator boundary per Gateway. It is not a hostile multi-tenant boundary for adversarial users sharing the same Gateway, host, credentials, or Agent.

​

Trust Model

• one user or trusted team boundary per Gateway;
• one OS user/host/VPS per trust boundary when possible;
• separate credentials, workspaces, and browser profiles for separate trust boundaries;
• split mixed-trust users into separate Gateways.

​

Quick Audit

fased security audit
fased security audit --deep
fased security audit --fix
fased security audit --json

• Gateway bind/auth exposure;
• DM and group policies;
• broad tool or elevated-tool access;
• browser/node exposure;
• weak local file permissions;
• plugin loading without explicit allowlists;
• risky debug flags;
• sandbox settings that look configured but are not active.

​

Recommended Baseline

{
  gateway: {
    mode: "local",
    bind: "loopback",
    auth: { mode: "token", token: "replace-with-long-random-token" },
  },
  session: {
    dmScope: "per-channel-peer",
  },
  tools: {
    profile: "messaging",
    deny: ["group:automation", "group:runtime", "group:fs", "sessions_spawn", "sessions_send"],
    fs: { workspaceOnly: true },
    exec: { security: "deny", ask: "always" },
    elevated: { enabled: false },
  },
  channels: {
    whatsapp: {
      dmPolicy: "pairing",
      groups: { "*": { requireMention: true } },
    },
  },
}

​

Network Exposure

1. gateway.bind: "loopback" with token auth.
2. Tailscale Serve, a direct tailnet path, or SSH tunnel.
3. Trusted reverse proxy with explicit gateway.trustedProxies.
4. LAN/custom bind only when intentional, authenticated, and firewalled.

• unauthenticated 0.0.0.0;
• public port forwarding to the raw Gateway;
• forwarding Tailscale identity headers from a custom proxy;
• relying on sessionKey as an auth boundary.

• set gateway.trustedProxies;
• make the proxy overwrite forwarding headers;
• use token/password or trusted-proxy auth;
• set gateway.controlUi.allowedOrigins when browser Origin differs from the Gateway origin.

​

Control UI Auth

• gateway.auth.mode: "token": shared bearer token.
• gateway.auth.mode: "password": password auth, preferably from env.
• gateway.auth.mode: "trusted-proxy": trust an identity-aware proxy.
• gateway.controlUi.allowInsecureAuth: local compatibility switch only.
• gateway.controlUi.dangerouslyDisableDeviceAuth: break-glass only.

​

DM And Group Access

{
  session: { dmScope: "per-channel-peer" },
}

​

Tool Authority

• exec / process;
• filesystem read/write/edit/apply_patch;
• browser control;
• gateway config/update calls;
• cron/task creation from untrusted paths;
• session tools that can inspect or message other sessions;
• node commands such as camera, screen, contacts, calendar, SMS, or shell.

{
  tools: {
    deny: ["gateway", "cron", "sessions_spawn", "sessions_send", "exec", "process"],
    fs: { workspaceOnly: true },
  },
}

​

Sandboxing

• run the whole Gateway in Docker;
• run host Gateway with Docker-isolated tools through agents.defaults.sandbox;
• keep workspaceAccess: "none" or "ro" for agents that do not need write access;
• keep scope: "agent" or "session" for isolation.

​

Browser And Node Control

• use a dedicated browser profile for Fased;
• avoid personal daily-driver profiles;
• keep browser/node hosts on tailnet-only access;
• disable browser proxy routing when not needed;
• pair nodes deliberately and treat node pairing as operator-level access.

​

Prompt Injection

• pairing/allowlists;
• group mention gates;
• minimal tools;
• sandboxing;
• restricted file roots;
• modern instruction-following models for tool-enabled Agents;
• reader/summarizer Agents for untrusted content before passing summaries to a higher-authority Agent.

• hooks.mappings[].allowUnsafeExternalContent
• hooks.gmail.allowUnsafeExternalContent
• cron payload field allowUnsafeExternalContent

​

Secrets, Logs, And Transcripts

• ~/.fased/fased.json
• ~/.fased/credentials/**
• ~/.fased/agents/<agentId>/agent/auth-profiles.json
• ~/.fased/secrets.json
• ~/.fased/agents/<agentId>/sessions/**
• ~/.fased/extensions/**
• ~/.fased/sandboxes/**

• use 700 on directories and 600 on private files;
• use full-disk encryption where practical;
• keep logging.redactSensitive enabled;
• add environment-specific redaction patterns;
• prune old logs/transcripts when no longer needed;
• review diagnostics before sharing.

​

Plugins And Dynamic Skills

• Install from sources you trust.
• Prefer explicit plugins.allow.
• Review plugin config before enabling.
• Pin package versions when installing from registries.
• Restart the Gateway after plugin changes.
• Restrict who can modify skill folders.

​

Incident Response

1. Stop the Gateway or app supervisor.
2. Close exposure: return gateway.bind to loopback and disable public access.
3. Freeze risky channels: use dmPolicy: "disabled" or stricter allowlists.
4. Rotate Gateway auth and remote client credentials.
5. Rotate provider/channel/model credentials if they may have leaked.
6. Review logs, session transcripts, and recent config changes.
7. Run fased security audit --deep.

• timestamp and Fased version;
• OS/host shape;
• redacted transcript and log excerpt;
• exact inbound message/content;
• whether the Gateway was exposed beyond loopback.

​

Security Reports

• SECURITY.md

​

Related

• Authentication
• Trusted Proxy Auth
• Sandboxing
• Session Management
• Logging
• Secrets