Security

Watari runs shell commands, drives a browser, sends messages, and edits its own code. The safety model makes that trustworthy: least surprise, full reversibility, deny-by-default.

Full detail is in SECURITY.md in the repo. This page is the summary; read the file before you deploy.

Confirmation tier — enforced in code

Outward-facing or destructive tools (send a message/email, delete a file, kill a process, run PowerShell, write to Notion/calendar, smart-home locks, self-edits/commits, run a protocol) are in a confirmation tier that is enforced in the agent's execution path — not merely requested in the prompt. The agent blocks the first attempt, reads the action back, and runs it only after your next turn affirms it. One “yes” authorises exactly one action. So even a weak model that ignores the prompt cannot fire a consequential tool unprompted. Reads and lookups are never gated.

Secrets

  • All secrets live in a git-ignored .env; only .env.example (no values) is committed.
  • Sessions, voiceprint.json, the audit log, browser profile, and private memory are git-ignored too.
  • The audit log redacts secrets two ways: by argument key, and by scrubbing any real .env value from results.
  • Use the narrowest token scopes (fine-grained GitHub PAT, Notion deny-by-default sharing, your own Google OAuth app).

Guardrails

  • Filesystem — deletes refuse protected paths and Watari's own secrets/state; no traversal.
  • Self-improvement — repo-scoped, secret-blocked; reversible-only git (no reset/force-push/rebase/branch-delete — a revert is a new commit); tests run before trusting a change.
  • Elevation — admin PowerShell is explicit; nothing silently elevates.
  • Speaker biometrics — optional; obeys only your enrolled voice, fails open until enrolled.
  • External fleet — deny-by-default; armed deliberately.

Network posture

  • Local-first: audio, wake word, VAD, and optionally STT/TTS run on your machine.
  • The brain binds loopback by default; off-loopback requires the bearer token and should sit on a private Tailnet, never the public internet.
  • An unconfigured integration makes no network calls at all.

Reporting

Found a way to bypass the path/secret guards, the confirmation tier, or a protocol password? Report it privately to the repository owner, not as a public issue.