Security and Approvals

Security and approvals

• Page content is data, never instructions. It is wrapped as untrusted before the agent sees it. There is no "run arbitrary JavaScript" tool.
• Approvals live in the browser. Submit, send, pay, accept terms, passwords and uploads wait for a click in the extension popup that the agent cannot answer. Unanswered prompts are denied after 2 minutes.
• STOP. The red button in the popup halts every agent action until you press Resume. Only the popup can resume.
• YOLO mode (off by default, set only by you in the popup) auto-passes approvals. It does not change what the agent may do.
• Local only. The daemon binds to 127.0.0.1, checks Host and refuses any request with an Origin header. Three separate secrets: extension token, MCP token, dashboard token.
• Secrets are redacted from what the agent sees, from exports and from generated code. Revealing them needs --allow-reveal when starting the daemon.
• Files: uploads only from ~/.config/browserforge/files, ~/Documents, ~/Downloads (or --allow-dir); writes only into the exports folder.
• No anti-bot evasion. CAPTCHAs are for you, except the opt-in browser_solve_captcha (local CapSkip app, needs YOLO mode).
• Plugins declare their permissions and you approve them; skills are guidance only.
• No telemetry, no accounts, no BrowserForge servers.

Please use BrowserForge only on sites and accounts you are authorised to automate or inspect, and respect their terms of service and the law.

Full threat model: docs/SECURITY.md · docs/PRIVACY.md. Reporting a vulnerability: see the Reporting section of SECURITY.md.