Security

Security

Phoenix assumes the internet is hostile and acts like it.

Fail closed

Empty allowlist? Nobody gets in. No web password? The web UI refuses to serve. Unknown sender? Ignored. You open every door on purpose.

The shell guard

[security]
approvals = true

Every shell command waits for you:

run command #3?
  rm -rf build/
[approve #3]  [deny #3]

Always on

• Path jail: file tools stay inside the workspace.
• Command gate: rm -rf / class commands are refused outright.
• Secret redaction: keys and tokens are scrubbed before anything reaches disk or chat, including passwords hidden inside URLs like https://user:pass@host.
• Clean environment: commands phoenix runs do not inherit your API keys, so a stray echo $ANTHROPIC_API_KEY has nothing to leak.
• Private network shield: fetches to loopback, private and link-local addresses are blocked, so a web page cannot talk phoenix into poking your router or a cloud metadata endpoint.
• Untrusted content is fenced: text pulled off the web is labelled as data, and internal markers are stripped from replies.
• Careful with your history: a damaged session file is set aside, never silently overwritten.
• Tight permissions: configs, memory and tokens are mode 600.

Check yourself

phoenix doctor

Audits your setup and says plainly what looks risky: loose file modes, plaintext passwords, approvals switched off, secrets sitting in the config instead of the environment.

Found a vulnerability? Please use private reporting.