Security

Last updated 31 July 2026

The kernel is open source, so most of this is checkable rather than assertable. Where something isn't done yet, it says so — a security page that only lists strengths tells you nothing.

The trust boundary

One idea underpins everything: the AI never holds a credential and never acts unsupervised.

• The agent runs in a sandbox with no secrets. It gets opaque, single-run handles.
• The harness holds every credential and makes every privileged call.
• Outward actions pass a human, or a policy envelope you defined — and an auto-approved action is still recorded with its reason, so autonomy is reviewable rather than invisible.
• Reads are ungated but scoped: GET only, host fixed by the connection, size-capped, budgeted, and traced.

Enforced today

• Credentials encrypted at rest (AES-256-GCM); only ciphertext is persisted.
• Tenant isolation at one chokepoint that fails closed. Asking for a project you can't see returns nothing rather than everything.
• Per-client credential isolation, enforced rather than defaulted.
• Hash-chained append-only audit with an on-demand verify.
• Client portal sessions are a separate credential plane — unrecognised on operator routes, not merely filtered.
• Session tokens in httpOnly cookies; no credential is reachable from a browser bundle, checked by a build-time verifier.

Not yet

• No SOC2. We're too young. Ask and we'll tell you where we are.
• No data classification. No field-level redaction or residency, so special-category data is out of scope.
• Per-task tool ACLs are coarse — governed by the approval gate rather than a per-task allowlist.
• No formal pen test yet.

Reporting something

security@mycelai.dev. We'll acknowledge within 48 hours and keep you updated. We won't threaten you for reporting in good faith.