Security model
A smaller browser interface is useful only when its boundaries are enforced.
Scope is configured by the operator
The service only accepts approved public HTTPS origins. Private, loopback, link-local, and cloud metadata addresses are blocked by a pinned-DNS egress proxy. Redirects and subresources remain subject to scope checks.
Credentials stay outside model arguments
Optional credential profiles are operator configuration. Authenticated sessions reject arbitrary page JavaScript and provide constrained assertions instead. Screenshots mask form fields; known secrets and cookies are redacted from structured results. Redaction is best effort, not a guarantee against a deliberately hostile page.
Isolate the runtime
The standalone reference service is one process on a dedicated host or container. It is not a replacement for a hardened multi-tenant execution platform. Run one deployment per trust domain; use a VM or isolated task per untrusted tenant.
Report a vulnerability privately
Follow SECURITY.md in the repository. Do not post credentials, customer data, or exploitation details in a public issue. An origin allowlist is not evidence of legal authorization; operators are responsible for target permission.