OpsPilot is a single-user tool (ADR-0002). Remote access is supported through the remote-access foundation (ADR-0011):
- Local (loopback) use needs no auth — the default bind is
127.0.0.1. - Remote binding is fail-closed:
opspilot serverefuses any non-loopback host unless an API token is configured (OPSPILOT_API_TOKEN). With a token set, every endpoint except/healthrequiresAuthorization: Bearer <token>(constant-time compare). - Always put TLS in front of a remote deployment — a reverse proxy (nginx/caddy) is the supported path; see docs/deployment.md. A bearer token over plain HTTP is trivially sniffable.
- There is still one user and one token — no accounts, roles, or audit-per-identity. Do not share a deployment across trust boundaries.
| Layer | What it does | What it is not |
|---|---|---|
| Redaction | Strips PII from work-item text before it reaches any model or the KB; placeholders are content-hashed per session | Not a substitute for manually sanitizing what you paste in |
| Sandbox L2 | AI-proposed shell actions run in an ephemeral hardened Docker container: read-only rootfs, cap-drop ALL, no-new-privileges, seccomp, tmpfs workdir, no host mounts, --network=none by default |
— |
| Sandbox L3 | Adds gVisor (runsc) user-space-kernel isolation; fail-closed — refuses to run rather than downgrade to L2 |
— |
| Approval gate | Flags risky command patterns (rm -rf, DROP TABLE, fork bombs, prod-env or network-opening actions) for human sign-off before apply |
Not a security boundary — a defense-in-depth signal and audit aid (ADR-0005). The boundary is the container + network policy |
- API keys are resolved from environment variables only — never committed.
.gitleaks.tomlconfigures the repo's secret scanning; rungitleaks git .before publishing forks. - The MCP client performs best-effort inline-secret detection in server configs (env/args/url/headers) — a footgun guard, not a guarantee. Keep secrets in the environment.
- Session traces and artifacts are stored locally under
~/.opspilot/sessions/and may contain redacted-but-sensitive context. Treat the state directory as confidential.
Please report vulnerabilities privately via GitHub private vulnerability reporting — do not open a public issue. Include reproduction steps and the commit or version affected. You should receive an acknowledgement within a week.