Skip to content

Security: dormstern/leashed

Security

SECURITY.md

Security Policy

Reporting a Vulnerability

If you discover a security vulnerability in leashed, please do not file a public issue.

Email: dormstern@gmail.com

Include:

  • Description of the vulnerability
  • Steps to reproduce
  • Impact assessment (what can an attacker do?)

We will acknowledge receipt within 48 hours and aim to release a fix within 7 days for critical issues.

Scope

leashed is responsible for:

  • Policy evaluation (deny/allow pattern matching)
  • Audit log integrity (append-only JSONL)
  • Session lifecycle (create, kill, budget enforcement)
  • Input sanitization (Unicode bypass protection)

leashed is not responsible for:

  • AnchorBrowser SDK security (report to AnchorBrowser)
  • Semantic prompt injection (glob patterns are a coarse filter, not a semantic security boundary)
  • Credential storage (API keys are your responsibility)

Known Limitations

  • Glob pattern matching operates on the literal task string. It cannot detect semantic equivalents (e.g., "forward" vs "send").
  • The audit log is a local file. For tamper-proof logging, export to an immutable store (S3 with object lock, a database, or syslog).
  • The expire timer and kill switch are best-effort — an in-flight AnchorBrowser task may complete after the kill signal.

Trust Model

leashed operates at the intent layer — it evaluates task description strings before forwarding to AnchorBrowser. It does NOT have visibility into browser-level execution.

Threat model

Threat Mitigated? Notes
Accidental scope creep (agent uses descriptive task names) Yes Policy gating blocks unintended categories
Credential exposure to agent code Yes Credentials stay in AnchorBrowser's isolated session
Unlimited session duration Yes Time-based expiration + action budgets
Session left running after use Yes leash.yank() + CLI npx leashed yank
Unicode obfuscation of task strings Yes sanitizeTask() strips invisible characters
Deliberately adversarial task labeling Partially Pattern matching is literal, not semantic
Direct AnchorBrowser API bypass No Agent with API key can skip leashed entirely
In-browser action divergence No AnchorBrowser AI executes autonomously
Prompt injection via web content No AnchorBrowser's responsibility — report to them

Defense-in-depth recommendations

  1. Use default: deny and explicit allow lists
  2. Keep max_actions low — budget limits blast radius even if patterns are bypassed
  3. Use expire_after — session auto-kills limit exposure window
  4. Review audit logs regularly — npx leashed audit or export JSONL to your SIEM
  5. For production: complement leashed with AnchorBrowser's own session monitoring

There aren’t any published security advisories