diff options
Diffstat (limited to 'SECURITY.md')
| -rw-r--r-- | SECURITY.md | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/SECURITY.md b/SECURITY.md index afa4e15..ffc2c06 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -9,13 +9,14 @@ Open a GitHub issue prefixed with `[security]` at https://github.com/tianrendong `pi-chrome` is a developer tool you install knowingly. It is **not** designed to defend against: - Hostile pages running in your Chrome trying to detect or escape automation. (Standard browser security boundaries still apply, but a hostile page that already runs in your tab can do anything that page can already do.) -- Other processes on your local machine. The bridge binds to `127.0.0.1:17318` (loopback only) but **does not authenticate** local callers. Any process running as your user can issue commands. If your threat model includes hostile local processes, run pi-chrome on a separate user account. +- Other processes on your local machine. The bridge binds to `127.0.0.1:17318` (loopback only) and chrome_* tools require `/chrome authorize` inside Pi, but the bridge does not authenticate arbitrary non-browser local callers. If your threat model includes hostile local processes running as you, run pi-chrome on a separate user account. `pi-chrome` **is** designed to: - Never exfiltrate page state to the network. All communication is loopback (`127.0.0.1`). - Surface every action with an honest result envelope so the agent can't silently do the wrong thing. -- Require explicit opt-in for trusted-input mode (`/chrome clicks on` or `trusted: true`), which uses `chrome.debugger` and shows Chrome's banner. +- Keep Chrome control locked until the user explicitly runs `/chrome authorize` in the current Pi session. +- Reject browser-origin command requests to the loopback bridge so ordinary web pages cannot use CORS to drive Chrome. ## The companion extension @@ -24,14 +25,13 @@ The Chrome extension under `extensions/chrome-profile-bridge/browser-extension/` ## Defaults - Loopback bridge only. No remote port. No telemetry. -- Synthetic events first; trusted CDP only when explicitly enabled. -- Quiet mode optional; tab/window focus is observable (the user can see Pi acting). +- Chrome real input layer for interactive controls. +- Chrome control locked by default; `/chrome authorize` unlocks current Pi session after terminal confirmation, `/chrome revoke` locks it again. +- Run-in-background optional; tab/window focus is observable by default (the user can see Pi acting). -## Override the port +## Custom ports -```bash -PI_CHROME_BRIDGE_PORT=17319 pi -``` +The bundled Chrome extension currently polls `127.0.0.1:17318`. Custom bridge ports are not supported without editing the extension source and reloading it. ## Supported versions |