# AetherDesk Security Notes

Status: paid-pilot draft.

## Default boundary

- PowerShell max access defaults to `read-only`.
- Host-write requires the server max access to be intentionally changed.
- The UI cannot arm host-write by itself.
- MCP hook toggles are intent/config, not proof of authentication.

## Receipts

System Access writes receipts for important control-plane actions:

- Sieve reads
- headless/visual checks
- recovery reads
- MCP hook status/toggle/sign-in intent
- PowerShell allowed and denied runs

Receipt route:

```text
/api/system-access/receipts
```

Receipt file:

```text
artifacts/aetherdesk_system_access_receipts.jsonl
```

## Denial gates

PowerShell denial tests should pass before paid handoff:

```powershell
npm run aetherdesk:system-access:hardening
```

## Connector security

- Do not paste OAuth tokens or API keys into chat or AetherDesk notes.
- Use owning connector sign-in flows.
- AetherDesk may show `present`/`missing` for env-backed credentials but must not print values.

## Disclosure

For paid pilots, report security concerns through the agreed support channel before public disclosure.
