> For the complete documentation index, see [llms.txt](https://yvechat.gitbook.io/wp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://yvechat.gitbook.io/wp/security.md).
# Security
Sovereignty is a security claim. This page states how it is defended.
Claims stated so they can be checked
***
### Threat Model
| Asset | Threat | Control | Status |
| -------------------------- | ------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------- | ----------------- |
| **Tool credentials** | Exfiltration by a hosted service or a compromised page | Credentials held inside the Engine process, never transmitted to YveChat | Available |
| **Conversation content** | Retention or training use by a platform | Conversations written to a local SQLite database, reaching YveChat at no point | Available |
| **The Engine itself** | A malicious origin pairing with it | Six-digit code, local approval, exact-origin allowlist, hashed tokens, expiry, revocation | Available |
| **Outbound tool requests** | SSRF against internal services | Public URL policy checked before every request, manual redirects capped, content types restricted, 2 MB cap | Available |
| **The user's identity** | Phishing through a cloned origin | Canonical origins published on [Verified Links](/wp/resources/verified-links.md), and the origin shown during pairing | Available |
| **The model context** | Prompt injection through tool output or MCP metadata | Tool metadata treated as untrusted, isolated from system context | Planned, with MCP |
| **The user's machine** | Arbitrary code execution through a local MCP server | Full untruncated command display and confirmation before execution | Planned, with MCP |
MCP is Planned, so the final two controls describe the contract that MCP support will carry. MCP server installation and arbitrary code execution sit outside the current trust boundary.
***
### Design Commitments
**Secrets never travel.** Credentials are written to Engine-managed local storage and attached to outbound requests from the user's machine. No YveChat-operated server holds a user credential.
**Consequential actions wait.** Reads run automatically with disclosed activity. Anything that writes, sends, purchases, changes settings, or authenticates requires explicit confirmation. This follows the MCP specification's requirement that hosts obtain explicit user consent before invoking any tool.
**Untrusted input stays untrusted.** MCP tool descriptions and annotations are treated as adversarial by default, in line with the specification's own guidance, and are kept out of system prompt context unless the server is designated as trusted.
**Credentials are never forwarded.** MCP's security guidance forbids token passthrough and requires servers to reject tokens not issued to them. The gateway issues per-server credentials, and the user's own credentials stay in place.
**Channels stay separated.** The tool gateway cannot reach the Engine. They are independently authorized, which prevents a model-directed request from turning the Engine into an internal-network proxy.
***
### Distribution Integrity
The Engine runs on the user's machine with the user's privileges, which makes its distribution chain part of the security surface.
| Control | Commitment | Status |
| ------------------------------ | ------------------------------------------------------------------------------------------------------------------- | ------------------------------------------- |
| **Signed releases** | Every Engine build code-signed for its platform. Preview builds are unsigned and publish a SHA-256 checksum instead | Planned |
| **Notarization** | macOS builds notarized | Planned |
| **Published checksums** | A hash published alongside each build | Planned |
| **Automatic updates** | An update mechanism with a rollback path | Planned |
| **Canonical sources** | Download origins listed on [Verified Links](/wp/resources/verified-links.md) | Available as a list, with downloads Pending |
| **Reproducible release notes** | Each release states what changed and why | Planned |
{% hint style="warning" %}
No public installer exists today, so none of the distribution controls above is active. YveChat Engine is built from source while release artifacts are outstanding. Progress against these items is tracked on [Release Readiness](/wp/resources/release-readiness.md).
{% endhint %}
{% hint style="danger" %}
A modified Engine would hold every secret the real one holds. Because no signed release exists yet, build from source you have obtained from a canonical origin. Signature and checksum verification become the required step once releases begin.
{% endhint %}
***
### Audit and Disclosure
**Independent audit.** A third-party security review of the Engine and the token contracts is planned ahead of token generation. Findings and remediation will be published.
**Bug bounty.** A disclosure program covering the Engine, the workspace, and the contracts is planned alongside the audit, with severity-scaled rewards.
**Responsible disclosure.** A dedicated security contact and reporting process will be published on [Verified Links](/wp/resources/verified-links.md). Reports receive acknowledgement, an assessment, and a remediation timeline.
{% hint style="info" %}
Audit, bounty, and disclosure processes are planned. None is active today. This page will state their status accurately at every stage. See [Disclaimer](/wp/resources/disclaimer.md).
{% endhint %}
***
### What Security Cannot Cover
Self-custody moves responsibility as well as control.
A lost credential limits access to the profile it opens, and a wallet-created profile depends on that wallet. A compromised machine exposes locally stored credentials and the conversation database. A machine with no backup loses its conversations permanently, because the local database is the only copy.
These are properties of custody itself. They are stated here so the trade is understood before it is made.
***
Custody is a claim.
A claim is only worth the controls behind it.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://yvechat.gitbook.io/wp/security.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.