Skip to main content
What this framework protects, from whom, and what it explicitly does not protect. The safety gate in ROADMAP.md requires this document and its release checklist to stay current; the per-surface findings, the fixes made and the residual risks live in Security.

​
Assets

​
Trust boundaries

Trusted: the operator’s bot code, plugins and flows, and the machine the process runs on. Untrusted: every platform payload, every end-user message, every model answer, every byte fetched from a URL that came from a payload, and any MCP client that talks to @botmesh/mcp.

​
Threats and controls

​
Assumptions

  • HTTPS terminates at the operator’s reverse proxy or platform; the process itself speaks plain HTTP on the loopback interface.
  • The machine is not shared with untrusted users: plugins and bot code are trusted.
  • Secrets arrive from the environment; the framework never reads .env on its own.
  • The operator’s store is authenticated and not reachable from the internet.

​
Out of scope

  • Multi-tenant authentication beyond the manager’s tokens (no OIDC, no RBAC).
  • Hardening of the operator’s host, container, database or reverse proxy.
  • WhatsApp / Meta / Telegram / Twilio terms of service compliance, and the legal basis for processing end-user data.
  • Denial of service above the ingress limits (network layer).
  • Model quality, hallucinations or vendor data-retention policies.

​
Reporting

Open a private advisory through SECURITY.md; never a public issue. A fix lands with a regression test named security-audit in its package.