From 27cbf2ba70b09b41664fd71a7fc622bd82712bfd Mon Sep 17 00:00:00 2001 From: tournierjc Date: Sun, 20 Sep 2026 21:32:56 +0200 Subject: [PATCH] docs: security boundaries wording (data dirs + no-telemetry egress note) Rebased replacement for PR #10's SECURITY.md hunk. The README hunks were superseded by upstream a5639bc (Uninstall restructure) and the fork's custom_provider line; the smoke.test.mjs hunk regressed the repaired suite (telemetry-marked fixtures, stricter proxy audit assertions) and is dropped. Co-authored-by: hermes-agent --- SECURITY.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index fd0759723..86a0b9539 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -10,8 +10,8 @@ Include the affected version, operating system and Node.js version, a minimal re ## Data and service boundaries -- The default data directory, `~/.minimax-code`, stores login state, provider configuration, and sessions. It is not shareable project configuration. Restrict local access and keep it out of Git. -- The process installs a default-deny egress guard (see [Network egress policy](docs/egress-policy.md)): model endpoints the user configured, loopback, and `MCODE_ALLOWED_ORIGINS` stay reachable, while the MiniMax managed-service and reporting hosts are refused. `MCODE_EGRESS_MODE=allowlist` is stricter; `MCODE_EGRESS_MODE=off` disables the guard and should be treated as a data-boundary change. +- The active data directory stores login state, provider configuration (including API keys in `config.yaml`), and sessions. Builds from this repository default to `~/.minimax` (or `~/.minimax-` when a profile is selected). Environment overrides can select another directory. Follow [Accounts and data](docs/installation.md#accounts-and-data) to identify it; the installer location alone does not identify stored credentials. Restrict local access to every data directory you have used and keep them out of Git, including old profiles (earlier source builds used `~/.minimax-code`). They are not shareable project configuration. +- The process installs a default-deny egress guard (see [Network egress policy](docs/egress-policy.md)): model endpoints the user configured, loopback, and `MCODE_ALLOWED_ORIGINS` stay reachable, while the MiniMax managed-service and reporting hosts are refused. This fork ships no telemetry. `MCODE_EGRESS_MODE=allowlist` is stricter; `MCODE_EGRESS_MODE=off` disables the guard and should be treated as a data-boundary change. - Plugins, MCP servers, search, and media tools the user configures may contact external services within that policy. Those services continue to control authorization and credits; source access does not grant access to accounts or third-party resources. - mcode-tools obtains short-lived access tokens through the host's lease broker. Never pass refresh tokens to tool processes. - Permissions and sandboxing do not replace review of untrusted plugins, MCP servers, and shell commands. If automatic permission classification is unavailable, retain user confirmation rather than allowing operations by default.