An automation can read data, change files, start programs, or control input. BaudBound therefore treats every imported package as untrusted until the local runner has checked it and the user has approved the exact installed revision.
The editor describes what the package intends to do. The runner makes the final decision. It reads the package, checks the graph and settings, calculates required access from the nodes, checks platform support, verifies the installed file fingerprint, and requires approval before an action can affect the machine.
Approval means that you accept the reviewed operations for one exact package revision. It does not mean the package came from a trusted author. It also does not allow invalid or unsupported behavior.
BaudBound also uses an Official blacklist for reviewed security concerns involving repositories, publishers, domains, scripts, and exact package files. See Official Blacklist and Personal Block List for the severity rules, privacy details, and repository controls.
The security model is designed to limit these failures:
BaudBound cannot decide whether an otherwise truthful automation is appropriate for your machine. An approved Shell node can still run a destructive command. An approved File Delete node can still delete the path its configuration resolves to. Review remains an operator responsibility.
| Boundary | Trusted responsibility | Not trusted as authority |
|---|---|---|
| Editor | Produces a structured graph, target, and review declarations | Its permission, capability, and risk claims |
.bbs package |
Portable input to strict parsing | Filename, display name, or manually edited archive contents |
| Runner parser | Enforces archive, document, graph, and configuration rules | Unknown nodes or extra package files |
| Security derivation | Recalculates permissions, capabilities, risk, and target compatibility | Package declarations that do not match the graph |
| Operator approval | Accepts one installed package revision and its access | Future updates or another script with a similar name |
| Native adapter | Performs an authorized OS operation | Shell emulation of an unsupported native feature |
| Desktop UI | Presents state and sends Tauri requests | Authorization decisions. Rust checks them again |
| Network edge | Delivers webhook or WebSocket input | Internet origin, proxy configuration, or payload safety by default |
The runner performs the relevant checks before graph execution:
A failure at any stage blocks the related run. Approval cannot override malformed data, a package-hash mismatch, unsupported targets, missing secrets, or disabled dangerous-action policy.
Sensitive desktop operations also require a short-lived confirmation guard issued by the Rust backend. The guard is bound to the exact operation and reviewed content, expires after two minutes, and can be used only once. Changing a package or config after review invalidates the guard. The backend rejects missing, expired, reused, or mismatched guards even when the frontend sends a command directly.
At import or update, the runner computes a SHA-256 hash of the complete .bbs file and stores it with the installed script record. Before status-sensitive operations and execution, it hashes the stored package again. A mismatch means the managed copy changed outside the runner and is no longer trusted.
A hash is a file fingerprint. BaudBound compares the current fingerprint with the one saved during import or update. If they differ, the runner blocks execution until the package is installed through the normal update and approval process.
This package hash detects local modification. It does not prove who authored or published the package. BaudBound does not currently provide package-author signatures. Obtain packages through a channel you trust, inspect their graph and access, and approve only the installed revision you intend to run.
Runner release signing is a separate system. Tauri updater signatures authenticate published runner update artifacts. They do not sign user-created .bbs packages.
Approval binds the installed script identity, current package hash, and reviewed access. Updating content changes the hash and makes the previous approval stale. Revocation removes the active approval without deleting the script.
Sub-scripts do not inherit their caller's trust. The called script must be installed, hash-valid, compatible, policy-allowed, and independently approved. This prevents an approved parent from smuggling an unreviewed package into execution.
Use Approvals, Capabilities, and Risk for the complete review workflow and policy controls.
Packages contain declarations such as a secret name, description, and whether it is required. Secret values are always text. Production values are configured on the runner after import. Stored values are encrypted, omitted from normal inspection, and redacted from runtime logs and stored snapshots where they are exposed to execution.
The encryption key is part of the backup boundary. Database records without the matching key cannot be decrypted. See Secrets and Storage, Backups, and Recovery.
Webhook and WebSocket listeners default to loopback. Each approved network trigger uses runner owned token protection by default. Approval displays newly created plaintext tokens once, then only their hashes remain in storage. Replacement tokens generated under Security are also displayed once. Browser requests require an exact configured origin. A non loopback bind is refused when any registered trigger has authentication disabled unless the operator enables the explicit unsafe override.
Token authentication does not provide TLS, rate limiting, or firewall policy. Put exposed listeners behind an appropriate reverse proxy and network controls.
Native actions use supported Rust libraries or operating-system APIs. The editor marks platform restrictions, package verification rejects incompatible targets, and runtime adapters reject unavailable behavior. BaudBound does not silently replace an unsupported native action with PowerShell, Bash, or desktop command-line tools.
Continue with BBS Package Format for the archive contract or Approvals, Capabilities, and Risk for operator review.