Security model

What the tool does to keep your hosts and your laptop safe, and what it leaves to you. It is part of the architecture; to report a problem, see SECURITY.md.

Rules:

• Nothing new listens on a host. sshd is the only door, or, for a host made with host create docker or e2b, the provider’s own authenticated exec API (Docker’s socket, E2B’s envd). There is no relay and no telemetry.
• Provider credentials are read, never kept. An E2B API key comes from your environment, the E2B CLI’s own login, or a command you name. It is kept in memory, and never written, logged or sent to a host. Lima and Docker need none.
• simstim stores no secrets. Agent logins live on the host, scoped to that host. Fine-grained GitHub tokens should be per host. A session can get secrets that a command fetches on the laptop at its start; they live only in that session’s environment, never in a file, a log or a command line.
• A repository’s setup script runs only after you trust it, once for each repository on each host. The client asks, and keeps the answer on the laptop (setup hooks).
• SSH agent forwarding is off by default. If a user turns it on, the stable SSH_AUTH_SOCK link makes it work across reconnects. The risk is written in the docs.
• Helpers are released signed, and checked by SHA-256 before install.
• Sockets and staged files are private: 0600 and 0700, owner checked.
• Forwarded ports (v2) bind to 127.0.0.1 only. Nothing is ever public.
• Untrusted host mode filters OSC 52, OSC 8 and report sequences from the host.

Threat model, in short:

• A compromised host can see everything its agents can see. It cannot reach the laptop beyond the escape sequences it prints, and untrusted mode filters those.
• A compromised laptop can drive every host it has keys for, as it already can through ssh.