Security policy

Supported versions

Only the latest release (and main) receives security fixes. Update a server with docker compose pull && docker compose up -d (see INSTALL.md).

Reporting a vulnerability

Please report vulnerabilities privately through GitHub Security Advisories on the repository: metor-com/metor -> Security -> Report a vulnerability (https://github.com/metor-com/metor/security/advisories/new). Do not open a public issue and do not post details in discussions or pull requests before a fix is released. You will get an acknowledgement, and once the report is confirmed, a fix and - if you want one - a mention in the advisory.

Scope

The gateway (port 6010) authenticates devices by default. The first device redeems a single-use setup link; further devices redeem pairing links or codes issued by an already signed-in device. Browsers use an HttpOnly session cookie; native clients can use a bearer token. The gateway stores session secrets as hashes and enforces a one-year session lifetime. Sessions can be revoked. See ADR-0012 and INSTALL.md.

Security reports about the following are in scope:

• Bypasses of setup, pairing, session authentication, expiry or revocation, including access to chats, files, administration, event streams, screen and terminal WebSockets.
• Failures in the gateway’s Origin/CSRF checks and native-client authentication boundaries.
• Escapes from the sandbox for bot-generated pages, exposure of credentials, and bypasses of approval controls that metor claims to enforce.
• Escapes from the container or unauthorized access to the user’s machine.

The bundled Caddy configuration provides TLS and forwarding, not a separate proxy login. METOR_AUTH=off explicitly disables device authentication. Operators using it must provide an external authentication layer protecting all /bots routes and WebSocket upgrades, or restrict it to isolated local experiments. Do not expose that mode directly to a network.

Current protection boundaries

A Space is a shared execution environment, not a security boundary between its bots. The gateway, bot hosts and runtime processes currently run as the same OS user. A bot with shell access can read runtime and connector credentials, access other bots’ files and browsers, and modify management files, including the device-session store. File permissions such as 0600 do not isolate those files from processes with the same user ID. Runtime tool-deny rules do not prevent an allowed shell from reading the same files.

This includes Space-owned OAuth credentials when configured. The sandbox for a bot-generated HTML page protects the page’s browser context; it does not restrict the bot’s shell process. Treat every bot and the content it processes as sharing the Space’s credentials and trust boundary. Do not use one Space to isolate mutually untrusted workloads. Management-plane isolation is planned in ADR-0018, not implemented protection. These known limitations do not exclude reports about credential exposure or management access.

Desktop websockify endpoints bind to container loopback; the wrapper publishes only the gateway. Screen access through the gateway requires device authentication by default. Older images and containers may still expose legacy ports 6011–6049: rebuild or update the image and recreate the container to remove those mappings. Do not publish or forward desktop service ports.

The desktop app injects Space bearer tokens only into requests from its registered, packaged UI and explicitly opened screen/terminal frames. Service frames are restricted to their bot’s service and clipboard endpoints. File previews receive authorization for the requested document, not its scripts or nested frames. Redirects do not inherit authorization for a different URL; untrusted renderer requests also lose Space session/watch cookies. Ordinary linked windows have no ambient Space credentials; use the app’s file preview and Download action for protected files. This browser-context boundary does not isolate bot shell processes (see above).

Use HTTPS for network access. Pairing authenticates a device but does not encrypt plain HTTP; a captured session secret can be reused until revoked or expired. Keep setup links, pairing codes, runtime credentials and volume backups private.

Claude Code, Codex and other bundled components are third-party software. Report issues in those components to their maintainers; issues in metor’s integration remain in scope (see THIRD-PARTY.md).

This page is metor-com/metor/blob/main/SECURITY.md in the metor repository, rendered as it is.