Security and privacy

Chrysalis runs code written by an AI agent and by other people, so it is built to keep that code in bounds. This page explains what those bounds are.

#Your data stays with you

• Chats, characters, apps and settings are files on the device running Chrysalis. There is no Chrysalis account and no Chrysalis cloud.
• Model keys are stored on the server, outside your workspace. They are never sent to your browser, to apps, or to the agent.
• Chrysalis goes online for things you set up or ask for: the model providers you connect, installing apps and their packages, the Store list, checking installed apps' repositories for updates when the launcher opens, and checking for a new Chrysalis version when an admin opens Settings > Server. Apps reach the internet only through plugins with the network permission.

#Accounts

• Every account has its own apps, data, agent and connections. Only the admin can change server settings or manage accounts.
• By default only the computer running Chrysalis can open it. Turning on network access lets other devices reach the sign-in page; every account still needs its password.
• Requests from unknown host names are refused, which protects against websites that try to reach Chrysalis on your network through your browser. Add names you use in allowedHosts.

#Apps

An app's page runs in a sandboxed frame with no access to your session, cookies, or the rest of Chrysalis. It can only reach its own server routes and a short list of shared ones (models, images, speech, embeddings, and shared assets). It cannot open the agent, your settings, other apps, or other websites directly, and the server enforces the same list.

#Plugins

Plugins run on the server in a sandbox. A plugin can only use what its permissions allow, and plugins that came from a repository, a file, or an import only get the permissions you approved:

• Installing or importing shows every plugin's permissions first; the install is the approval.
• A community app's update that asks for a new permission stops and asks you again.
• File access is limited to the app's own data folder. Network access goes only to the hosts a plugin lists in its manifest, and your computer and local network are blocked.
• You can turn any plugin off, or remove it, from the app's Plugins dialog.

#Backups and imports

An exported backup contains the app's data, so treat it like the data itself. When you import one, Chrysalis unpacks it into a separate folder, refuses files that try to land outside it, and shows you what it contains before installing. An app restored from a file is never marked official, whatever it claims.

#The agent

The agent works inside your workspace. Its command shell runs in your browser tab, not on the server. The shell can reach the internet (never your computer or local network) until you turn that off in Settings > Agent. Every file it writes is saved to your workspace history.

#Report a vulnerability

Please report security problems privately through GitHub's security advisories, not in a public issue or on Discord. Include your Chrysalis version (chrysalis --version), how you run it, and the steps to reproduce.