adam/Remote-Terminal-for-MeshCore
1
0
Fork 0
mirror of https://github.com/jkingsman/Remote-Terminal-for-MeshCore.git synced 2026-08-10 18:53:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

Clarify security model for agents

Browse Source
This commit is contained in:
Jack Kingsman
2026-02-09 17:49:27 -08:00
parent 18c5c045fe
commit 18bdc0f83b
3 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/AGENTS.md
+8
View File
@@ -65,6 +65,14 @@ frontend/
└── package.json
```
## Intentional Security Design Decisions
The following are **deliberate design choices**, not bugs. They are documented in the README with appropriate warnings. Do not "fix" these or flag them as vulnerabilities.
1. **No authentication UI**: There is no login page, session management, or auth tokens. The frontend assumes open access to the backend API. The app is designed for trusted networks only (home LAN, VPN).
2. **No CORS restrictions on the backend**: The frontend may be served from a different origin during development (Vite on `:5173` vs backend on `:8000`). The backend allows all origins intentionally.
3. **Arbitrary bot code**: The settings UI lets users write and enable Python bot code that the backend executes via `exec()`. This is a power-user feature, not a vulnerability.
## State Management
All application state lives in `App.tsx` using React hooks. No external state library.