Security
The model never gets a shell
WhosePort is designed so that a wrong diagnosis is an inconvenience, not an incident. These are the rules the system enforces, not guidelines the model follows.
What the system never does
- Expose unrestricted local shell access to a model.
- Let prompt text override the action policy.
- Treat model output as trusted executable code.
- Upload raw secrets to the cloud.
- Let one organization read another organization's evidence.
- Execute an unapproved mutating action.
- Assume an action succeeded without verification.
What it always does
- Validates every tool argument against a schema at the tool boundary.
- Authenticates agent-to-cloud traffic and authorizes every request.
- Scopes agent credentials to a single environment.
- Records every action, approval and result on the investigation timeline.
- Redacts sensitive evidence on your machine before upload, and again in the cloud.
- Enforces investigation budgets: tool calls, model calls, time and evidence volume.
- Re-checks every action against policy on your machine before running it.
- Relaunches a process only with the exact command line it was running with.
- Lets only the person who asked, or an org admin, approve a fix, and only once.
- Rate-limits sign-in, sign-up and new investigations.
- Refuses browser requests to the local agent, so a web page cannot query it.
The execution boundary
flow
Cloud AI → Typed action → Policy engine → Approval → Local agent → Result → Verify
The cloud can reason, compare snapshots and produce plans. It cannot run commands or read files. Only the local agent has OS access. It reads project .env files for variable names and host and port targets only, and it accepts typed actions from a fixed list, never natural-language instructions.
Actions
| Class | Actions | Default |
|---|---|---|
| Low risk | http_retry, refresh_snapshot | Allowed |
| Mutating | stop_process, restart_process, restart_container, update_runtime_config | Requires approval |
| Not an action | Shell commands, file deletion, volume removal, Docker prune | Cannot be proposed at all |
Data handling
- Redaction runs by key name, token pattern and URL credential detection. Deterministic code, not a model.
- Agent tokens are stored hashed, scoped to one environment and revocable from the dashboard.
- Each environment keeps its most recent 200 snapshots; older ones are deleted.
- Every database query is scoped to the caller's organization, and cross-organization access is covered by automated tests.
Reporting a vulnerability
Email security@whoseport.com with the details and steps to reproduce. Please give us a chance to fix the issue before disclosing it publicly.