Security

RemoteEndpoints security boundary

Review the authority, account risk, control boundaries, and current proof limits before pairing a computer.

Highest-consequence account risk

Account access can become computer access.

Anyone who takes over the owning RemoteEndpoints account may be able to see private desktop pictures and direct every paired computer while its extension remains enabled.

Passkeys and multi-factor authentication are not implemented yet. Use a unique password, protect the email account used for verification, sign out on shared devices, and revoke unfamiliar computers immediately.

Security at a glance

Understand the authority before you pair.

Standing authorization: Installing and enabling the RemoteEndpoints extension is the intentional authorization for unattended remote control. A person is not expected to be at the target computer to approve each prompt. One-time pairing binds that authorization to the owning account.
Signed-in Windows authority: LocalEndpoint Connect AI can use the desktop, programs, files, browser and network sessions, pointer, and keyboard available to the signed-in Windows account, subject to installed capabilities, Windows permissions, and desktop state.
Website and Connect roles: RemoteEndpoints authenticates the remote operator and carries prompts, control messages, private desktop pictures, and status. The enabled RemoteEndpoints extension lets LocalEndpoint Connect AI perform the work on the target computer; the website itself does not invoke Windows APIs.

Current proof limits: Reviewed Connect source integration exists, but matching current-public-package compatibility, an installed production end-to-end round trip, and autonomous multi-turn visual work are not proven. This server does not implement hosted global MemoryEndpoints agent-name or immutable .uai ownership leases and fencing; distinct agents and true branches remain supported.

Private workspace discovery

Private computers are account-bound—not published for public discovery.

Search instructions reduce accidental exposure; they are not the lock.

Private workspace URLs are omitted from the public sitemap.
Every private response—including redirects and errors—sends a noindex directive.
Server-side account authentication and ownership authorization decide access; robots.txt does not.
The browser never scans localhost, the local network, or Windows for computers. After sign-in, RemoteEndpoints shows only computers deliberately paired to that account.

Know before pairing

Pairing creates standing unattended access.

Installing and enabling the RemoteEndpoints extension is the intentional authorization for unattended remote control. A person is not expected to be at the target computer to approve each prompt. The one-time account pairing binds that authorization to the owning account.

Current release gate: The current public Connect package is not yet verified end to end for RemoteEndpoints. Use the safe mock unless you are an informed tester who accepts the open signing, clean-machine, and plugin-compatibility gates.

Protect the account that will control the computer.

Use a unique password, secure the email account used for verification, and sign out on shared devices. Passkeys and multi-factor authentication are not available yet, so account takeover remains the highest-consequence risk.

Review the account-protection answer

Accept the authority you are enabling.

Connect AI can use programs, files, browser and network access, pointer, and keyboard available to the signed-in Windows account, subject to the installed Connect capabilities and current desktop state.

The website carries private pictures, prompts, state, and results. It does not call Windows APIs itself; the paired Connect installation performs the computer work.

See the authority flow Review the unverified package gate

Choose the boundary that matches your intent

Stop, pause, disable, and revoke are different controls.

Use the narrowest control that solves the immediate problem, and revoke whenever the device credential itself should no longer authorize future access.

Current run

Remote Stop

Requests cooperative cancellation of the active Connect AI run at its next safe boundary. It does not block a later prompt or remove remote authority.

Account delivery gate

Pause

Closes account-side delivery, stops work that has not started, and signals running work to stop while preserving the pairing. Resume reopens only the account gate; it cannot override a locally disabled extension or invalidate the durable credential.

Target-computer gate

Disable or uninstall

Disabling closes the extension's local authorization gate; uninstalling removes that independent capability. Neither should be treated as server-side credential revocation.

Device credential

Revoke

Invalidates the server-side durable credential, terminates queued state, signals Connect to stop, deletes retained desktop pictures, and prevents future account control until fresh pairing. It cannot reverse a Windows effect that already completed.

Two independent gates must remain open. After one-time account pairing, Remote control is active while the RemoteEndpoints extension is enabled in LocalEndpoint Connect and account delivery is not paused. Pause delivery or disable the extension to suspend unattended access; revoke the computer to end the pairing.

Try the safe mock — no installation Review exact tester package facts Understand the authority architecture

The first-time pairing explanation keeps the release gate visible and does not start an installer.

Already paired? Sign in to My computers.

Advanced: multi-agent and memory ownership boundary

Parallel Connect instances remain supported. Each active agent must use a distinct normalized MemoryEndpoints name and its own .uai memory identity; a deliberate true branch has a new identity and can run concurrently. This RemoteEndpoints server does not yet implement the matching hosted ownership enforcement.

What the paired system can do with a matching Connect build

Authenticate the operator.
Keep a paired Connect computer reachable while nobody is there.
Show private pictures captured from its signed-in desktop.
Carry prompts to LocalEndpoint Connect AI and return private results.
Operate programs, browser/network sessions, pointer, and keyboard through Connect's enabled capabilities.
Request remote stop, pause prompt delivery, and revoke a device credential.

What the website component does not do directly

Scan localhost or private networks.
Read local files without going through the paired Connect computer.
Call Windows APIs from the web server or browser.
Open inbound tunnels.
Bypass the independent extension or a revoked/disabled device credential.
Control a Windows sign-in screen, locked desktop, or UAC secure desktop with the current interactive desktop lanes.

Threat outcomes

A boundary should produce a predictable result.

Security concerns and the protection each boundary provides
Concern	Protection
RemoteEndpoints account takeover	May become control of every paired computer. Use a unique password and revoke unfamiliar devices immediately; passkeys/MFA are not implemented yet.
Stolen durable device token	The token is device-scoped, stored as a server-side digest, rotatable, and invalidated on revocation; client storage must use Windows Credential Manager.
Duplicate work polling	Atomic claim leases and one-time claim tokens prevent concurrent polls from executing the same prompt.
Malicious picture payload	JPEG/PNG/WebP signatures, hashes, dimensions, timestamp age, and byte limits are validated; SVG and HTML are rejected.
Operator pause or local disable	Effective authority requires both account delivery and the target extension to remain enabled; neither side can silently override the other.
Device revocation	Terminates queued server state, signals Connect to stop active work, invalidates the durable token, and deletes retained desktop pictures. It cannot reverse a Windows effect that already completed.

Website release controls

How RemoteEndpoints site releases are verified

The owner-operated release workflow restricts the deployment package and compares every uploaded member with the same fixed package copy. Separate live checks recompare selected runtime files and confirm that selected sensitive paths are denied.

Restricted package scope: Only four named root files and regular files inside the RemoteEndpoints runtime tree are eligible for the deployment package.
Same-attempt upload comparison: Every uploaded package member is read back in that deployment attempt and compared by byte length, SHA-256, and exact bytes.
Separate live runtime recheck: A separate verifier compares a fixed list of live runtime files with the corresponding local files present when that check runs.
Selected sensitive paths denied: Credential-free, header-only probes require each selected sensitive path to return 403, 404, or 410. Response bodies are not read.

Evidence boundary: These are owner-operated, first-party checks—not independent certification, a third-party audit, or a content-wide secret scan. The live recheck covers a fixed file list and selected sensitive paths; this evidence does not verify, sign, or certify the LocalEndpoint Connect installer.

Technical release controls and limits

Evidence boundary: These are owner-operated build, deployment, and live-site checks. They are first-party operational evidence—not independent certification, a third-party audit, or a content-wide secret scan.

Fixed runtime allowlist: Packaging is limited to four named root files and regular files inside the RemoteEndpoints runtime tree.
Pre-package scope checks: Before ZIP creation, the builder preflights the selected runtime scope. Within that selected scope, configured private-setting filename candidates fail closed; configured generated-file candidates remain outside package selection. Symbolic links, Windows junctions and other reparse points, multiply-linked (hard-linked) regular files, special files, or missing required root markers also fail closed.
Source identity: Included regular files are checked by path before opening, on the opened handle before and after reading, and by path again after reading. Their payloads are loaded before ZIP creation.
One package, one fixed copy: Before validation, the deployer loads one bounded ZIP snapshot from one identity-checked, singly linked regular-file handle. For a CLI release attempt that reaches reservation, the package SHA-256, ZIP inspection, digest used to key the local attempt entry, and every uploaded member's bytes all come from that same fixed in-memory copy.
Package integrity: The expected package structure, required root markers, member names, duplicates, restart order, and ZIP CRCs are checked before upload.
Same-attempt readback: A deployment passes only when every package member is read back during that attempt and matches the bytes loaded from the package by exact byte length, SHA-256, and byte equality.
Restart ordering: The restart marker is uploaded exactly once and last, only after every other member passes readback; the marker is then read back too.
Separate live checks: A separate verifier hash-compares a fixed list of server runtime files with the local files present when that check runs. Credential-free, header-only probes check a fixed list of sensitive paths and pass only when each returns 403, 404, or 410; no response bodies are read.

Review the separate Connect installer status

Data visibility

Public, private, and local information stay distinct.

Public / display-safe

Public product information only

Product, setup, security, and troubleshooting documentation
Clearly synthetic demo computers, pictures, prompts, and results
Machine-readable API descriptions without live customer data
No desktop pictures, prompts, app names, results, or device identifiers

Private operator view

Private operator data

Prompts, Connect AI results, and run state
Private desktop picture bytes and capture metadata
Computer identity, capabilities, heartbeat, and activity
Pause, stop, credential rotation, and revocation state

LocalEndpoint Connect only

Windows API calls and local runtime handles
Files, program state, and local AI observations not intentionally returned
Execution-time target validation and local task state
Local credentials and private computer state

Compare every stored data category, lifecycle, and deletion boundary.

Technical token handling

RemoteEndpoints token classes
Token	Purpose	Handling
Account session	Own paired computers, prompts, pictures, results, stop, pause, and revoke controls	HttpOnly, SameSite cookie or API bearer; stored as a purpose-scoped digest.
Device-code setup token	Pair one Connect installation after browser confirmation	Short-lived, single-use, and stored only as a purpose-scoped HMAC digest.
Durable device bearer	Authenticate Connect heartbeats, work leases, state, and private picture uploads	Returned once to Connect, stored in the Windows credential store by the client, and stored server-side only as a digest.
Command claim token	Bind one leased prompt to one Connect worker attempt	Short-lived, rotated on lease recovery, and stored only as a purpose-scoped digest.
Legacy session tokens	Compatibility with the former short-lived request protocol	Deprecated for unattended control and not used by the persistent computer workspace.

Logging and redaction policy

Examples use placeholders. Public templates avoid account tokens, durable device tokens, command claim tokens, credentials, prompts, results, desktop pictures, application names, and device metadata. Private activity uses server-authored summaries and never stores prompt or result text.

Browser security headers

The app sets CSP, frame denial, nosniff, referrer policy, permissions policy, conservative no-store headers for dynamic/private responses, and cacheable headers for static assets. HSTS is added when the configured base URL is HTTPS.

Vulnerability reporting

No verified public vulnerability-reporting address is currently published in this codebase. RemoteEndpoints does not publish an unmonitored address. Do not place secrets, tokens, private logs, prompts, generated text, or credentials in public forms or status links.