Skip to content

docs(security): clarify optional policy gateway boundary #611

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jiezeng2004-design wants to merge 3 commits into
base: main
Choose a base branch
from
Open

docs(security): clarify optional policy gateway boundary #611

Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
de9df98
docs(security): document external policy gateway pattern
jiezeng2004-design Jul 25, 2026
dd694ad
docs(security): keep gateway guidance vendor-neutral
jiezeng2004-design Jul 25, 2026
fdac04b
docs(security): require fail-closed gateway behavior
jiezeng2004-design Jul 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 15 additions & 1 deletion SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,20 @@ If the AI client should never be able to reach the rest of your machine, that gu

Terminal command execution is a first-class feature. Because it can launch arbitrary programs, path-based and command-based restrictions can be circumvented by design — for example via shell substitution, absolute paths, or invoking another interpreter. These controls are advisory: they make common mistakes less likely; they are not a boundary against a client that is actively trying to escape them.

## Optional external policy gateway

Deployments that need a policy decision for each operation can place an external
policy gateway between the AI client and Desktop Commander. A gateway can
normalize a tool call, apply file and command policy, request human approval,
forward allowed calls, and write a redacted audit record.

This is an additional governance layer, not a sandbox. It can govern only calls
that are routed through it; a client connected directly to Desktop Commander can
bypass the gateway. Keep OS-level isolation in place when containment is required.
Comment thread
coderabbitai[bot] marked this conversation as resolved.

Desktop Commander does not require or imply support for any particular gateway
implementation.

## Recommended deployment for stronger isolation

For any workload where the AI client must not access the wider machine, run Desktop Commander inside an isolated environment:
Expand Down Expand Up @@ -64,4 +78,4 @@ If you'd prefer not to disclose publicly, reach out via Discord to arrange priva

---

*Last updated: July 2026*
*Last updated: July 2026*