Security boundaries

Workflow

SecretBridge exposes no Web or MCP API to read or export raw credentials. A human decides in the local console; the broker uses OS-stored values for approved operations and filters results before storing or returning them. SSH host-key and HTTPS certificate checks are enabled by default.

Boundary and checks

These controls govern operations routed through SecretBridge. If the AI client also has unrestricted shell, file or network access under the same user, it may bypass the broker. Filtering does not identify every encoding, transformation or unrelated sensitive value.

Five distinct boundaries

1. Storage: secret values live in the OS credential store; SQLite holds references, state and operational metadata. Web and MCP offer no secret-read or export interface.
2. Decision: a user approves in an authenticated local page or voluntarily supplies a one-time TOTP code for one reviewed pending request. MCP cannot set policy, read authenticator material or approve by itself.
3. Execution: the broker uses a credential temporarily for a configured target and authorized action. Web binds to loopback by default; MCP connects through same-user local IPC.
4. Results: terminal output, runs and history are filtered for bound secrets before storage or return, with field, size and cursor limits.
5. Target identity: HTTPS certificates, database TLS and SSH host keys are verified according to configuration, without automatic downgrade on failure.

Not a replacement for OS isolation

The terminal runs as the current OS user, not in a hostile-code sandbox. If an AI client also has unrestricted terminal, file or network access, it can bypass SecretBridge’s interface. Malware already executing as the credential owner may access that account’s processes, files or credential store. Least-privilege OS accounts and target permissions remain necessary.

Redaction covers secrets actually bound by the broker and explicitly supported representations. Arbitrary Base64, hashes, encryption, custom transforms, unbound business data and deliberate exfiltration by a program are outside that promise. Approve trusted programs and minimal output. On suspected exposure, stop related new work, rotate the source credential and retain only reviewed minimal evidence. Report a potential vulnerability through private vulnerability reporting.

Continue: approvals · SSH host keys · secure terminals.