Security model · September 28, 2026

Guardrails with named limits.

Commandem coordinates tools that can edit code and run commands. Its job is to make authority explicit, bound unattended work, and leave evidence. Orchestration still carries risk.

Default safeguards

• Use an explicitly isolated launch mode, such as autopilot with --worktree, for implementation work. Isolation is not universal across every mode.
• High-risk operations remain behind explicit policy and approval boundaries.
• Profiles and receipts identify the effective provider account and model.
• Verification gates can require tests, changed artifacts, HTTP health, browser rendering, and JavaScript-error checks.
• Secret redaction and protected-path rules reduce accidental credential exposure.
• Kill, pause, and quota controls bound active work and spend.

Evidence and causality

A passing command is not automatically proof of the requested outcome. Commandem records the claim, gate, evidence, revision, and freshness. Replay distinguishes observed facts from reconstructed or unknown causes, while Experiments own measured comparisons.

Profiles and privacy posture

Profiles bind accounts, Loadouts, tools, project settings, and privacy posture. Unknown training or retention settings remain unknown. Failover between accounts is explicit and should be present in the receipt.

Website protections

The static site declares restrictive browser headers for framing, transport, referrers, permissions, content sources, and object embedding. The catalog refreshes through the same-origin registry proxy; review integrations separately. The site does not expose a credential-entry form.

Plugin capabilities

The Marketplace shows a capability summary for each plugin (network access, file access, commands it names). For an example or hand-installed script, those rows are declared by the author and are not enforced by anything; read the source before installing. A plugin installed through the moderated plugin registry additionally runs network-denied by default when it declares no network access. Every other declared capability stays disclosure, not an enforced wall.

Known limits

• A permitted local agent process inherits the authority of its execution environment.
• Model-provider and third-party service behavior is outside Commandem’s security boundary.
• Redaction is defense in depth, not a guarantee that every sensitive string is recognized.
• Experimental and pre-release features may have incomplete provider parity; those gaps should be surfaced, not hidden.

Reporting

A verified security contact and coordinated-disclosure process are release prerequisites. Read the current reporting boundary. Until then, no unauthenticated public issue tracker or security mailbox is represented here as available.