Security Policy — Sharpin Remote Commander

Security contact: info@digital-pinball.com

Trust boundaries

1. The MCP/OAuth relay is Internet-facing.
2. Each device agent initiates outbound HTTPS only; no inbound port on the user's PC is required.
3. A signed-in user can address only devices owned by the same relay tenant.
4. Server policy cannot grant a local capability disabled by the device agent.
5. Filesystem operations cannot escape configured local roots/workspaces.
6. The public and private capability profiles are separate security boundaries.

Public profile

APP_PROFILE=public is the only profile intended for public OpenAI submission. It does not advertise arbitrary terminal execution or arbitrary process control in MCP tool discovery or OAuth scopes. Public file operations are constrained to public_workspace_root, use relative paths, reject absolute/traversal paths and retain the local Restricted Data guard.

The endpoint submitted to a public directory must never be configured with APP_PROFILE=private; this does not prohibit the separately authorized owner-only HTTPS read/fetch deployment. OPENAI_SUBMISSION_MODE=true is an additional startup guard for the submission deployment.

Private profile

APP_PROFILE=private is intended only for a trusted private deployment. It can expose terminal and process-control functions when both the server policy and local agent configuration enable them. Interactive process input is checked by the same restricted-command/data guard used for initial process commands.

Authentication and authorization

• OAuth 2.1 Authorization Code with PKCE S256 for user-facing MCP authorization.
• Resource binding and short-lived access tokens.
• Access, refresh, session, enrollment and device credentials are stored as hashes in the application database where supported by the protocol flow.
• Refresh tokens rotate/revoke on use.
• Device credentials can be revoked immediately.
• Capability checks are enforced at both relay and local-agent layers.

Data minimization

• queued job arguments exist only until an agent claims the job, then args_json is scrubbed;
• completed results are deleted when consumed;
• orphan completed jobs are removed after approximately five minutes;
• audit rows contain tool/action metadata and success state but not file contents, command strings, terminal input or full path values;
• audit retention defaults to 30 days;
• remote payloads are not used for advertising or model training by the Sharpin Remote Commander operator.

Production state and secrets

Production currently uses PostgreSQL for durable state. SESSION_BACKEND=database stores presence and account rate limits in SQL and does not require Redis. SESSION_BACKEND=redis requires REDIS_URL. Memory state and SQLite remain isolated-test modes. MySQL/MariaDB support is not yet implemented. Live production-backend validation is a deployment gate.

Application secrets, database credentials, SMTP credentials and the OIDC signing key must stay outside every document root in a least-privilege configuration/secret store. Managed cloud secret services are optional, not a shared-hosting pilot prerequisite. No OpenAI API key is required for the normal MCP, OAuth or device relay path.

HTTP/browser hardening

The public service should use HTTPS only, secure/HttpOnly/SameSite session cookies, HSTS, CSP/frame protections, request-size limits, origin checks, rate limiting, safe proxy configuration and managed load-balancer/WAF controls where appropriate.

Restricted Data

The public agent blocks known credential/key stores and high-confidence secret/payment/government-ID patterns locally. This is defense in depth, not a guarantee that arbitrary files are safe to expose. The public workspace must be dedicated to content intentionally made available to the connected AI client and must not contain PHI, PCI-regulated payment-card data, authentication secrets, private keys or other prohibited/restricted data.

Signed updates

Agent release packages are SHA-256 checked and RSA-signed. The update signing private key must remain isolated from production agents and public repositories; agents contain only the public verification key.

Responsible disclosure

Report suspected vulnerabilities to info@digital-pinball.com with the affected version/endpoint and minimal reproduction steps. Avoid:

• accessing data not belonging to you;
• persistent access or lateral movement;
• destructive changes;
• social engineering;
• denial-of-service/load testing without prior written permission;
• publishing a vulnerability before a reasonable remediation window.

There is no automatic entitlement to payment or a bug-bounty reward unless a separate program is announced.

Production security gates

Before public launch/submission:

• stable HTTPS custom domain;
• managed secret storage and least-privilege service accounts;
• encrypted database backups and tested restore;
• centralized logs that exclude bearer/device tokens and MCP payload bodies;
• alerts for elevated authentication failures, 5xx errors and abnormal device behavior;
• dependency/SBOM and container scanning;
• independent penetration test focused on OAuth, tenant isolation, SSRF, path traversal, job routing and agent update integrity;
• documented incident/breach process and OpenAI notification path where platform terms require it;
• legal/privacy review matched to actual processors and commercial model.

Shared-hosting pilot hardening (2026-09-18 development candidate)

The phase-0 profile disables public registration and retains only the six read/fetch tools externally.

New password records use Argon2id; legacy PBKDF2 verification and successful-login upgrades preserve existing accounts.

Post bodies and tool input schemas are checked; account rate limits and transactional user/device/global queue caps are enforced.

Risky HTTPS operations require a one-time approval bound to owner, device, action, complete parameters and expiry.

The internal grant interface is not an MCP tool. A secure user-facing approval UI remains a release gate.

Tool annotations are not used as the sole authorization model.

On Windows, agent credential and pending-job state use current-user DPAPI. The agent journals execution before

starting it. A crash with uncertain execution requires manual review, not automatic repeated execution.

A lost result acknowledgement retries the same result; a short-lived server receipt matches its hash and device.

The receipt does not retain output content. Claimed arguments are scrubbed; pending results remain locally encrypted

until acknowledgement. Expired entries are eligible for cleanup, whose scheduling interval affects physical retention.

All dispatched read/write tools and dispatch denials create payload-free action-audit metadata. Authentication and

schema/size rejects still require a complete separate ingress audit before public launch. Do not claim total audit coverage.

UNC/device namespace paths are rejected before resolution; agent config/state paths are protected even when relocated.

Restricted-data pattern checks cannot guarantee arbitrary shell code never reads a secret. Full shell access is not

an OS sandbox; keep it unavailable on the public read/fetch pilot. Output-capture memory and Windows reparse-point

race hardening, independent penetration testing, and live PostgreSQL/Redis testing remain required.

No external hosting deployment or official review is represented as successful by these source changes.