Security

Security

Phoenix assumes the internet is hostile and acts like it.

Fail closed

Empty allowlist? Nobody gets in. No web password? Web UI refuses to serve. Unknown sender? Ignored. You must explicitly open every door.

The shell guard

[security]
approvals = true

Every shell command waits for you:

run command #3?
  rm -rf build/
[✅ approve #3]  [❌ deny #3]

Plus always-on: path jail (file tools stay in the workspace), a command gate (rm -rf /-class commands refused), secret redaction before anything hits disk or chat, and 0600 permissions on configs, memory and tokens.

Check yourself

phoenix doctor

Audits your setup and tells you plainly what's risky.

Found a vulnerability? Please use private reporting.