Documentation · Security Model

Your keys stay in the vault — never in the agent

reading time: 6 minupdated: 2026-08-16

Threat model

Laptop theft — the only thing on the device is a revocable Remote Agent key in a 0600 file. No provider keys, no vault, no conversation history.
Stolen device key — can reach the device API but is scope-isolated from account-admin and destructive routes.
Session hijack — sensitive actions require a fresh two-factor challenge (15-minute grant).
Source disclosure — backup/SQL/config files are blocked from the web.

Key vault

Provider API keys are encrypted with AES-256-GCM (random IV + auth tag) using a server-side vault secret. Keys are stored in the database only in encrypted form, are never returned by the API, and never leave the control plane — the agent calls LLM providers through the plane, not directly from your machine.

Rotating the vault secret invalidates stored keys. Re-add them from Settings → API Keys.

Two-factor authentication

TOTP (RFC 6238) via Google Authenticator / Authy / 1Password — 30s window, ±1 interval tolerance.
Email OTP via the site's SMTP mailer — 6-digit code, 10-minute expiry, hashed at rest, 5-attempt lockout.
Recovery codes — 8 one-time codes issued at enrollment, stored as SHA-256 hashes, single use.
15-minute grant — one successful challenge unlocks sensitive actions for the session.

Guarded actions: adding/removing LLM API keys, generating/revoking device keys, forgetting devices, deleting agents and the factory reset. When 2FA is enabled, each returns 403 code=2fa_required until challenged; the dashboard auto-prompts and retries.

Bearer-scope isolation

Device tokens authenticate /api/v1/agent/* and a read-only slice of /api/v1/mona/* (chat, runs, telemetry, insights). Tokens are never accepted in URLs (no ?key=), parsing is case-insensitive, and wildcard CORS is disabled — the client is a CLI, not a browser.

Web hardening

*.bak*, *.sql, .env, config.local.php, logs and dev probes → 403; directory listing off.
Headers: HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
CSRF: session token verified with hash_equals; CSRF cookie is SameSite=Lax; Secure; HttpOnly.
Rate limiting on every write; per-plan caps on agents, steps and daily runs.

Audit chain

Sensitive events (key added/removed, token generated/revoked, 2FA changes, resets, LLM calls) are recorded in an append-only audit log with IP and timestamp, and security alerts are emailed. Read it anytime under History.