Security Model

Security Model

Tepegoz is security-sensitive because it combines untrusted web content, browser sessions, local secrets, and an AI agent that can take actions. The design assumes page content, renderer input, model output, MCP payloads, and adapter responses are untrusted.

Main Assets

• User credentials and sessions.
• BYO AI provider keys.
• Browsing data, page content, screenshots, form input.
• Event journal, token ledger, memories, blobs.
• Local machine access and authenticated third-party services.

Trust Boundaries

• Renderer to preload to main.
• Isolated web content to browser tools.
• Model output to tool gateway.
• MCP/client adapters to capability plane.
• Main process to external network/provider calls.
• User-data storage to OS keychain encrypted values.

Core Controls

• Renderer is untrusted.
• One secure createWindow() factory.
• Context isolation and sandboxing.
• Typed IPC and sender checks.
• Zod validation at every boundary.
• Policy kernel before tool execution.
• Human-in-the-loop approval for risky calls.
• Egress firewall and redacted logging.
• Secrets only in main process through safeStorage.
• Fail-closed behavior where a policy or route cannot decide.

Security Reporting

Do not open a public issue for security problems. Use GitHub private vulnerability reporting or email with the subject prefix [tepegoz-security].

Good reports include:

• commit/version,
• OS,
• what an attacker gains,
• smallest reproduction,
• page fixture or scripted agent goal when possible.

Known Caveats

• No independent security audit yet.
• Builds are unsigned.
• Some decision layers are landed but not live.
• Some roadmap defenses are future plans, not current mitigations.

Sources

• docs/threat-model.md
• SECURITY.md
• docs/engineering-rules.md
• packages/security-policy
• packages/capability-plane