Security · Dashcat

Two ways to connect

You choose for each node. A node can allow both.

Default

The Dashcat connector

Add one address to your AI agents and they work from anywhere, including the web and your phone. Requests pass through Dashcat's cloud on their way to the node, and the cloud can read them as they do.

For high-security work

Direct mode

Run Dashcat's bridge on your own computer. It connects straight to your nodes, end to end, and Dashcat's cloud never sees a command. Set a node to Direct only and the connector cannot reach it at all.

What Dashcat's cloud sees through the connector

The connector is not end to end. Dashcat's cloud reads each request to know which node it is for, then passes the node's reply back to your AI agent. In plain terms:

It sees, as it passes them on: every request your AI agents send, such as the commands they run, the files they read or write and the text they type into apps, and every reply, such as command output, file contents and screenshots.
It does not keep any of that. A request and its reply are held in memory until the reply is delivered, then dropped. Dashcat does not write them to a database or to its logs.
It keeps: your account's email address and name, and for each node its name, operating system, Dashcat version, whether it allows the connector, its public key and when it was last online.
It runs on Cloudflare, so this traffic passes through Cloudflare's systems. Both legs, from your AI client and to the node, are encrypted with TLS.

If Dashcat's cloud were broken into, an attacker could send commands to every node that allows the connector, until their owners pause them or set them to Direct only. Nodes set to Direct only would be out of reach, and each command would still be written to the node's own activity log before it ran. If that risk is too much for a machine, set it to Direct only.

How the connector is protected

You sign in to connect your AI. Your AI client signs in to your Dashcat account with OAuth, and reaches only your account's nodes.
Every request is signed. A node that allows the connector pins your account's key when it joins, and runs a request only if that key signed it. The cloud keeps the key sealed under a secret held apart from its database.
Requests are narrow and short-lived. Each one names a single node and expires within 60 seconds, and a node refuses any request it has already seen.
Only the node can say yes. Switching a node between Direct only and allowing the connector is done on the node itself. Dashcat's cloud can never do it.
The person at the node can stop it. Pause remote access in the tray closes the connection until they turn it back on. The node can also limit what the connector may do, as it can for a bridge.
Limits against abuse. Requests are rate limited per connection, per account and per node, and Dashcat can suspend an account that abuses the service.

In Direct mode

Pairing never sends the code. You pair with a one-time code that lasts 5 minutes and is spent after 3 wrong attempts. Both sides prove they know it with a password-authenticated key exchange (SPAKE2), bound to both machines' keys.
Mutual TLS 1.3 with pinned keys. Each machine has its own Ed25519 key. Your bridge accepts only the key it paired with, and refuses a node whose identity has changed.
Trust is checked first. A node rejects any bridge that is not on its trust list before it runs anything.

On every node

Commands run as the user who started the agent, with that user's permissions. Nothing runs as administrator unless you start the agent that way.
Each request is written to the node's activity log before it runs, with who sent it. Text your AI types into apps is logged as its length only.
Stop trusting a bridge with dashcat-agent bridges revoke. Its next request is refused, even in a session that is already open.
Each node can limit what each bridge, and the connector, may do: read files, see the screen, run commands, change files, or click and type in apps. See Permissions.
Keys and trust lists are files readable only by their owner.

What the preview does not do yet

The Dashcat connector is not open yet. Today the preview works in Direct mode, on your own network. What this page says about the connector is how it works in testing.

Everything is allowed by default. Until you limit a bridge or the connector, it can do anything the node's user can, including taking screenshots and typing into apps without the person at the node being told. The activity log shows what was done afterwards.
Keys are files, not in the OS keychain.
The dashboard can't list or revoke connections yet. Until it can, pause a node or set it to Direct only to cut every connection off from it.
Builds are not signed yet. Signed installers and automatic updates come before the public launch.

Reporting a vulnerability

Email security@dashcat.ai with what you found and how to reproduce it. Please give us a chance to fix it before you publish. The same address is in security.txt.

The files Dashcat keeps on each machine are listed in the security docs and configuration docs.