Node integration is off; context isolation, renderer sandbox, CSP, web security, trusted-frame IPC, denied web popups/permissions/downloads, and HTTP(S)-only preview navigation are enabled.
Python receives a minimal environment, not ambient provider credentials, and runs with -s and
PYTHONNOUSERSITE=1 so a per-user site-packages directory cannot shadow the locked dependencies.
browser-use telemetry, cloud sync, version checks, and LangSmith tracing are disabled, and .env
loading is suppressed with PYTHON_DOTENV_DISABLED, the variable python-dotenv actually reads. Its
profile has extensions and downloads disabled; upload/read/write/replace-file, PDF save, and
arbitrary evaluate tools are excluded. No user browser profile or file allowlist is supplied.
API keys are protected by Electron safeStorage / Windows DPAPI, not by hardcoded electron-store
encryption. The renderer never receives the secret or its ciphertext — only a has_api_key flag.
Saving an empty key preserves the existing one only at the same API root; changing roots clears the old key so a cloud key is never accidentally sent to another host. Moving the settings file to another Windows account may make the key undecryptable; save it again.
The plaintext key necessarily exists briefly in process memory and the private stdin pipe. It is
redacted from renderer-bound output in both its raw and JSON-escaped forms, along with Bearer
tokens and sk- keys found in third-party output. Redaction is not general data-loss prevention.
Endpoint URL handling: HTTPS is required for non-loopback API hosts. Embedded credentials, query-string API keys, and fragments are rejected. Corporate/private endpoints must provide trusted TLS; TLS verification is never disabled.
The automation worker is not an OS security sandbox. It runs as the current user. Temporary profiles, tool exclusions, and prompts reduce risk but do not guarantee resistance to page/model prompt injection. Websites and their resources can access the network, and remote debugging is loopback-local, not authenticated against other local-user processes.
Tasks may submit forms or perform irreversible actions; there is no per-action human approval gate.
Use trusted endpoints, disposable test accounts, and a dedicated low-privilege Windows account or VM for sensitive workflows. Do not enter payment, health, or production administrative tasks without additional policy enforcement. A production enterprise rollout needs organization-specific domain/network allowlists and approval controls.
This repository is implemented and integration-tested software, not a claim of universal endpoint compatibility, a security audit, or zero-configuration access to paid LLM services.