Security posture¶
What a buyer can read before trusting an unattended agent company on their
own machine. The full threat model is in docs/THREAT-MODEL.md; how to
report a problem is in SECURITY.md.
The boundary is the OS, not a prompt. Every workload runs under the operating system's sandbox from a settings file the workloads can read and not edit: no write outside its ledger, default-deny egress with the sources named, no reach to the console's port or its state root. The contract and the guard machinery are protected paths a workload cannot change.
What the OS holds is not identical on both, and here is the difference.
| macOS | Windows (native) | Windows, with Docker or Podman | |
|---|---|---|---|
| Writes | kernel (Seatbelt) | kernel (low integrity level) | kernel |
| Reads | kernel | SoloINC | kernel |
| Network | kernel | SoloINC (egress gate) | kernel |
| Process tree | kernel | kernel (job object) | kernel |
On native Windows, reads and outbound connections are enforced by SoloINC's own file tools and egress gate rather than by Windows, because Windows has no filesystem or socket boundary a program can put around itself without an administrator — AppContainer needs a loopback exemption an administrator grants, and socket filtering means the Windows Filtering Platform, which is an administrator too. SoloINC never asks you for an administrator password, so it uses what it can hold without one and tells you what that leaves out. Installing Docker Desktop or Podman Desktop closes the gap and SoloINC prefers it automatically, on every check, with nothing to switch on. A Windows machine with neither is refused scheduled agents rather than given unsandboxed ones.
One credential, one purpose. The seat token is a mode-600 file. The
console's passphrase is hashed; a CRITICAL change needs a one-shot second
factor -- one that hands out or changes a credential, one that binds or
exposes the company to the outside world, one that cannot be taken back.
Destructive but reversible changes ask you to confirm instead. Setting the
product up never asks for either, and ordinary work does not stop for
either. App keys are scoped (read, write, otlp) and hashed at rest; the
telemetry key can only append telemetry. Metered API keys are never in a
run's environment unless the Human's API switch is on.
Doors are shut until opened. The A2A agent card and the A2A inbound door
are 404 until switched on from the Security screen. MCP needs an app key.
OTLP needs its own key scope. Every POST needs a session and a CSRF header;
a foreign Host is refused; the CSP has no inline scripts or styles.
Nothing phones home. Telemetry is local. The update check is a GET for public release metadata once a day, switchable off. Licence keys are verified offline.
Credentials never leave. The console redacts anything credential-shaped from every document it publishes; the hosted dashboard is encrypted before it is uploaded and verified after.
Audited, reversible. Every action is on the audit log with who, what and
what it was before. pip-audit runs in the test suite against the one pinned
dependency. An accessibility pass runs statically in CI; contrast and
keyboard traps are checked in the desktop window after each merge.
Report a vulnerability to security@soloinc.ai. Acknowledged within 3 business days, assessed within 10, fixed in the next release when confirmed. No bounty programme; acknowledgement in the release notes if you want it.