Reference·Safety and trustIndex

Safety and trust

What protects the machine, and what Nodecode does not protect.

Updated Oct 6, 2026

Nodecode has no sandbox. Read the limits before you connect a channel or run unattended.

Protections

Protection	What it does
Loopback gateway	The gateway, the local server shells attach to, listens on `127.0.0.1`.
Host check	A request whose `Host` is not `127.0.0.1` or `localhost` gets 403.
Origin check	A socket opened by a page of another origin gets 403.
Operator token	Every `/api/gateway/` route needs `Authorization: Bearer TOKEN`. `/healthz` needs none.
File modes	Secrets are readable by you alone. See the table below.
Kernel lock	The kernel, the locked core, refuses redefinition of its names.
Secret redaction	`config-get` shows a secret as `[set]`. `config-set` refuses to write `[set]` back.
Channel allowlists	A Discord or Telegram bot refuses to start without an allowlist.
Channel tokens	A bot token is named by a `_env` or `_file` key. Inline tokens are not read.

Token source	Order
`NODECODE_GATEWAY_OPERATOR_TOKEN`, then `NODECODE_OPERATOR_TOKEN`	1
`~/.nodecode/operator-token`: 32 random bytes as hex, made on first boot	2
`gateway.operator_token` in the config	3

nodecode web prints a link that carries the token after #. A browser never sends that part to a server. Keep the link to yourself.

Path	Mode
`~/.nodecode/`	0700, set when the store opens
`operator-token`, `auth.json`, files in `secrets/`, `link/state.json`	0600
`backups/`	0700. Each archive: 0600.
`config.jsonc`	No mode is forced. A write keeps the mode the file has.

The model can lower the kernel lock itself with lower-floor. The store records who asked and why.

Fact	Consequence
Eval has full host authority.	The model can read, write and run anything your user can.
A new process isolates a crash only.	It does not stop file or network damage.
Cell folders are full-authority code.	A folder under `~/.nodecode/cells/` loads in every Nodecode process. Nothing asks first.
The guard is not a sandbox.	It refuses known spellings. Any other spelling runs.
Built-in guard rules are gated.	A file edit that mentions `rm -rf` is not refused.
Channel messages run with full host authority.	Anyone on an allowlist can drive eval on this machine.
Writes outside the session's folder are not snapshotted.	`/undo` cannot restore them.

For unattended work, supply containment outside Nodecode: a container or a host policy.