adam/Remote-Terminal-for-MeshCore
1
0
Fork 0
mirror of https://github.com/jkingsman/Remote-Terminal-for-MeshCore.git synced 2026-08-11 03:03:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

Clarify security model for agents

Browse Source
This commit is contained in:
Jack Kingsman
2026-02-09 17:49:27 -08:00
parent 18c5c045fe
commit 18bdc0f83b
3 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/AGENTS.md
+8
View File
@@ -40,6 +40,14 @@ app/
└── ws.py # WebSocket endpoint at /api/ws
```
## Intentional Security Design Decisions
The following are **deliberate design choices**, not bugs. They are documented in the README with appropriate warnings. Do not "fix" these or flag them as vulnerabilities.
1. **No CORS restrictions**: `CORSMiddleware` in `main.py` allows all origins, methods, and headers. This lets users access their radio from any device/origin on their network.
2. **No authentication or authorization**: All API endpoints and the WebSocket are openly accessible. The app is designed for trusted networks only (home LAN, VPN).
3. **Arbitrary bot code execution**: `bot.py` uses `exec()` with full `__builtins__` to run user-provided Python code. This is intentional — bots are a power-user automation feature. Safeguards are limited to timeouts and concurrency limits, not sandboxing.
## Key Architectural Patterns
### Repository Pattern