Security

The Dashcat connector

The connector is not end to end. Dashcat’s cloud reads each request to find its node, and passes the node’s reply back to your AI agent, so it can read both. It keeps neither: a request and its reply are held in memory until the reply is delivered. In Direct mode the cloud is never in the path. See Privacy for what the cloud keeps.

• Choice per node. Each node allows the connector or is Direct only, set in its agent.toml (hosted). Only the node changes it; Dashcat’s cloud cannot. A Direct-only node never pins a cloud key, so the cloud can’t send it commands.
• Signed commands. At join, a node that allows the connector pins its account’s cloud key (Ed25519). Every command is signed with that key and carries the node’s id, a request id and an expiry at most 60 seconds ahead. The node refuses a bad signature, another node’s id, an expired command and any request id it has seen, and logs the refusal.
• The channel is one outbound WebSocket over TLS to app.dashcat.ai, opened with a request signed by the node’s own key. The node opens no port for it.
• Your AI apps, one by one. Each AI app signed in to the connector is a connection in Dashcat Dashboard. Limit it to some nodes, or remove it to shut it out at once.
• Pause remote access in the tray closes the channel until the person at the node turns it off. The connector has its own permissions on each node, as a bridge does.
• Whole groups. run_on_group sends one signed command per node, each checked by its node like any other, and each counting against the rate limits. It runs on at most 50 nodes and never retries one.
• Abuse controls. Connector requests are rate limited per connection and per account, node connects per node, and sign-in and join attempts per IP address. Dashcat can suspend an account that abuses the service.
• If Dashcat’s cloud were compromised, an attacker could send commands to every node that allows the connector, until their owners pause them or set them to Direct only. Each command is still written to the node’s activity log before it runs.

Signing in to Dashcat

• You stay signed in on each browser and Dashcat app while you use it at least once every 90 days, for up to a year, then sign in again.
• The sign-in cookie is readable only by app.dashcat.ai and never by the page’s scripts. Dashcat’s cloud keeps only a hash of it. Its value changes every day, and if an old value is used again, Dashcat signs that device out, because it means someone copied the cookie.
• The Dashcat app keeps its cookie encrypted with your computer’s keychain.
• Settings › Signed-in devices lists every browser and Dashcat app signed in as you. Sign out any of them, or all of them at once if you lose a computer.

Teams

• Roles. Owners and admins add and remove nodes, groups, node invites and people. Members can see the team’s nodes and groups but change nothing, except adding nodes when the team allows it. Only an owner makes or removes an owner, and a team always keeps at least one.
• Team invite links work once, for 7 days, and Dashcat keeps only a hash of their secret.
• Removing someone takes away their access at once. Their AI apps stop reaching the team’s nodes, because every connector request checks that the person is still in the node’s team. They stay signed in to their own Personal team.
• One connection, every team. An AI app reaches the nodes of every team its person is in, each team’s within what that team’s Connections page allows. Commands to a team’s node are signed with that team’s own cloud key, and name the person who asked.
• A log of changes. Each team keeps a record of who added or removed nodes, groups, people, invite links and AI apps, and who changed its settings. Its members can read it; nobody can edit or delete it.
• Each team is separate. A team’s nodes, groups and invites are visible only to its members.

Direct mode and every node

• Identity. Each agent and each bridge installation has its own Ed25519 key, created on first run. Machines are identified by the key’s fingerprint.
• Pairing uses SPAKE2 with the one-time code, bound to both TLS keys, so a man in the middle is detected even if they know the code.
• Connections are mutual TLS 1.3. The bridge accepts only the agent key it paired with and refuses the connection with “the node’s identity has changed” otherwise. The agent rejects any bridge not in its trust list before running anything.
• Permissions. Each paired bridge has a rule for each kind of action: allow, ask the person at the node, or deny. Everything is allowed until you change it. See Permissions.
• Revocation. dashcat-agent bridges revoke refuses the bridge’s next request, even in a session that is already open, and its next connection.
• Activity log. Each node records which bridges connected, every request and how it ended, and every permission change, in a file only the node’s user can read. See Activity log. A bridge that can run commands can also change that file.

Not yet

• Private keys are files readable only by their owner, not yet in the OS keychain.
• With the default permissions, a paired bridge can take screenshots, and click and type in apps on its nodes, without the node’s user being told. Set screen and control to ask on nodes whose screens show what that bridge’s users shouldn’t see. Text typed through type_text or set_value is logged, recorded in the activity log, and shown in approval requests, as its length only.