What does the container boundary protect?
The managed computer uses separate browser and shell containers, non-root processes, dropped capabilities, resource limits, a read-only root filesystem, and a seccomp profile. It has no Docker socket, host network, or published sandbox ports. The shell sees its workspace and does not mount the browser profile.
The host daemon owns the vault, policy, audit, and task database. Its default listener is loopback at 127.0.0.1:7777. Remote access should use SSH or a private network such as Tailscale. Hosting this informational website does not make it a place to host the daemon.
Sandbox egress uses a proxy with destination policy and private-address blocking. It does not decrypt TLS, and domain policy remains best effort. Container or runtime vulnerabilities, permissions you add, and misuse of an already-signed-in website session are outside a guarantee of containment.
Does BotHearth ask before every action?
No. New destinations and detected sends, payments, uploads, and deletes can require an operator decision. Ordinary interaction on approved sites and writing a result into the task workspace may proceed without another prompt. Classification relies on observed signals and cannot identify every possible effect.
The model's MCP token cannot approve its own requests, create computers, acquire operator control, or open the operator's live view. UI sessions use a separate operator credential. Approval decisions are checked at the daemon boundary and bound to the task, proposed action, destination, control epoch, and expiry.
Webpages, downloads, documents, and tool descriptions can contain prompt injection. Even an approved website may serve malicious instructions. Review previews and outputs, use dedicated test accounts, and stay present for sensitive tasks. A local approval never overrides website terms or someone else's data rights.
Can the model see a password during human control?
During acknowledged human control, ordinary agent actions and model screenshot/snapshot tools are blocked. Live frames are sent only to the authenticated operator; takeover frames and input are not routed into model results or retained in BotHearth task/audit records.
The daemon transports your input, and the destination website receives it. If you paste a secret into chat, the model can receive it. After you return control, later page content can become model-visible. Saved browser cookies remain on the computer's profile volume.
Control expiry pauses the session rather than automatically restoring agent capture. Give control back checks the page before resuming. Passkeys and hardware WebAuthn generally cannot be completed inside the container browser.
Where does my task data go?
Self-hosting keeps the daemon and its primary storage on your host. Remote model providers, visited websites, installed connectors, notifications, and paired clients receive the data needed for their operations and apply their own retention rules.
| Data | Location or recipient | Retention |
|---|---|---|
| Tasks, messages, approvals | Host SQLite database; model-visible portions go to the provider. | Local records remain until removed; provider policy applies to its copies. |
| Screenshots & snapshots | May be in task/tool records and submitted model context. | No automatic screenshot expiry is implemented. |
| Browser logins | Per-computer profile volume, not encrypted by BotHearth. | Ordinary computer destruction retains the profile unless explicitly wiped. |
| Workspace & audit | Configured host files; audit includes a chain-head file. | No general per-task purge command or scheduled retention policy. |
| Provider keys | Encrypted host vault; the master key uses the selected key provider. | Retained until removed. Native CLI authentication is managed separately. |
| CLI history & logs | Native harness histories and BotHearth runner diagnostics on the host. | Review separately; deleting task data does not purge these histories. |
Back up and remove data deliberately
Stop the daemon before copying data. Preserve the configuration, database, intended workspaces and browser volumes, audit file and chain head, and access to the vault's original key provider. Encrypt backups.
bothearth computer destroy <name> removes computer containers; --wipe-profile additionally removes saved browser logins. Workspace files and host task/audit records require separate removal. Stopping the daemon does not erase records, and deleting local files cannot revoke copies sent to providers or paired devices. Follow the complete privacy and removal guide before removing an installation.
What does this website collect?
This informational site consists of static HTML, local CSS, local fonts, and images. It adds no analytics scripts, forms, account system, advertising trackers, or cookies. It does not run agents or receive task prompts.
The site is configured for GitHub Pages hosting. The hosting provider receives ordinary connection and HTTP request data, such as IP addresses, for operating its service; see GitHub's privacy statement. Following a source or documentation link sends a request to the destination site under its policy.
The displayed screenshots are unretouched development captures. They contain test tasks and retain older labels; they are examples of the interface, not a claim about a live visitor session.
How do I report a vulnerability?
Contact maintainer Sanjay Bhat by email with a short impact summary, version or commit, host OS, container runtime, and reproduction outline. Agree on a safe way to share sensitive details. Use private GitHub reporting if it is enabled for the repository.
Do not publish unpatched exploit details, tokens, bootstrap links, cookies, raw task databases, or vault contents in a public issue. This alpha carries no security certification or guaranteed response time.
Implementation references: full security model, privacy and retention, provider requirements. Reviewed 2026-09-08 for v0.0.1 alpha.