Security and Privacy

Security and Privacy

Cascade can invoke third-party APIs, operate on local files, run terminal commands and automate browsers. Treat it as a powerful automation platform with explicit trust boundaries, not merely a text chatbot.

Provider credentials and settings

• Keep API keys and tokens out of committed files, logs, issues and public wiki pages.
• Supported key sources include local configuration/environment variables, platform-native storage and carefully scoped credential linking.
• Manual, end-to-end-encrypted account sync: settings can be pushed or pulled between supported web, desktop and CLI clients. The account server relays encrypted content; the sync passphrase remains on the originating/receiving device.
• Gateway bearer tokens must remain associated with the gateway endpoint that issued them, and Azure credentials must stay resource-scoped. Credentials must not follow cross-origin redirects.
• Hosted web provider keys are user-controlled; a multi-user deployment must not silently spend its operator's provider keys for other users.

Permissions and hostile input

Potentially destructive shell, git, filesystem and browser tools are subject to permission controls and escalation. Webpages, retrieved documents, MCP responses and generated content are untrusted: none should override the user's approval or the server's security policy. Browser lease ownership must prevent racing human and agent input.

The fetch tool has SSRF protections, but self-host operators should still minimize network privileges and avoid providing untrusted users with arbitrary remote browser endpoints. The local dashboard binds to loopback by default.

Self-hosting warning

CLOUD_DEV_BYPASS=1 bypasses authentication. Never expose it beyond loopback-local development.

External deployments need real OAuth, HTTPS, secure session secrets, network restrictions, persistent data and proper per-tenant isolation. Review Cloud-and-Self-Hosting before changing the Docker port binding.

Local execution

Not every code execution path is a strong sandbox. If the optional isolated-vm component is absent, the runtime may expose broader filesystem/process access to code. Grant execution capability only to trusted tasks and workspaces.

Vulnerability reporting

Do not open a public issue for a security vulnerability. Use GitHub's private security advisory form. Include a reproducible case, impact, affected commit/version and redacted logs.

Sources: SECURITY.md, docs/key-sync.md, src/config/, safe-fetch.ts.