# Security policy and PoC constraints

## Supported status

Version `0.2.x` is a proof of concept, not a production internet service.

## Required deployment controls

- Keep the plugin listener on its hard-coded `127.0.0.1` bind.
- Put TLS, request-rate limits and public access policy in a dedicated relay or tunnel.
- Publish only `/v1/chat/completions`; keep `/health`, `/v1/cancel` and `/v1/reset` local.
- Use a unique, random token of at least 32 URL-safe characters.
- Store the token and Shengwang App Certificate through the plugin page or configured credential references. Never put either value in Cordis YAML, source control, screenshots or issue reports.
- Secret inputs are write-only: the browser receives only `configured` and `writable` status. The host resolves each secret immediately before the operation that needs it.
- Run the voice session in a workspace that contains no secrets it does not need.

## Current safeguards

- Loopback-only dedicated listener.
- Constant-time full Bearer-token comparison.
- Bounded headers, request body, user text and cancellation wait.
- One active request with cancellation convergence and stale-event fencing.
- One plugin-owned Harness lifecycle; unload and reset dispose it explicitly.
- Empty scoped tool allow-list, preventing all Harness tool execution by the voice agent.
- No transcript, prompt, token, cwd, model or session id in normal bridge logs or health output.
- App Certificate remains on the Harness host; only a one-hour channel-scoped RTC capability is returned to the browser.
- Configuration and live-session routes require a plugin-specific header plus same-origin browser metadata and emit `no-store` responses.

## Known PoC limitations

- A bearer token remains valid until it is replaced in Harness credentials.
- There is no per-user identity, replay defense, quota, audit sink or distributed session routing.
- The same bearer token authorizes chat and local control endpoints; public routing must filter paths.
- The bridge does not validate a Shengwang source IP or signed webhook identity.
- Model text is passed to Shengwang TTS without a content-safety layer.
- Conversation history remains in the live Harness session until reset/unload according to the host's configured session services.
- The browser voice path depends on Shengwang account entitlement and managed ASR/TTS availability; the plugin cannot enforce the provider account's billing or regional policy.

## Reporting

Do not include credentials, transcripts or private workspace data in a report. Provide the package version, Node/Harness versions, redacted request shape and a minimal reproduction.