Security model
No system is unhackable. These are the controls this deployment actually enforces; details are in SECURITY.md.
- Website import is an SSRF boundary: https/443 only, no IP literals, every DNS answer must be globally routable, the validated address is the one connected to (no rebinding), redirects re-validated, strict size/time/page limits, isolated secret-less scraper.
- Prompt injection is contained by privilege, not wording: the extraction model has no tools, network or secrets and can only emit a strictly validated profile that the owner must confirm.
- No generated code: one prewritten runtime serves every agent from validated data. All public A2A/MCP skills are read-only. Payments, bookings and orders are unsupported and fail closed.
- ANS identity ≠ trust: only agents passing the 15-point checklist are contacted; replies are shown as untrusted text and can never trigger a local action. Tokens are never forwarded.
- Browser security: opaque
__Host-sessions, per-session CSRF + Origin/Fetch-Metadata checks, strict CSP without inline script, autoescaped templates, owner-scoped queries, idempotent mutations. - Secrets: the GoDaddy credential and ANS private keys live only in the private control plane; logs and proof bundles are redacted and scanned before export.
Circuit breakers
agent_creation | enabled |
external_fetch | enabled |
remote_agent_calls | enabled |
llm | DISABLED |
writes | enabled |