# Security model

Loopback plus a token file — possession of the Mac is the auth. What that buys, and what it deliberately does not.

## Security model (deliberate)

Loopback-only + token file = *possession of the user's machine is the auth*.
Any process running as the logged-in user can read the token and therefore
fully drive the deck — including spawning a `shell` pane and typing into it,
which is arbitrary command execution. That is the product: the deck is an
execution surface for agents the user already lets onto the machine. Do not
expose the port beyond loopback; there is no rate limit, scoping, or token
rotation (delete the token file and restart the app to re-mint). The one
guard is against accidents, not attackers: closing a pane the human opened
needs `force`, because addresses move and a bot's stale `1.x` has hit a live
session.