Security & Privacy

Where your data lives

NevoFlux is local-first. Your sessions, knowledge base (~/.gbrain/), config, and API keys are stored on your own machine. The agent runs as a local process bundled with the browser.

What leaves your machine: the requests you send to your chosen LLM provider go to that provider, and any MCP servers or web tools you use reach their respective endpoints.

API keys

Keys live in config.toml or in environment variables — NevoFlux does not use an OS keychain. Treat config.toml as a secret file and avoid committing it anywhere.

The agent asks before it acts

How much runs without a prompt is set by Agent execution in Settings → General. It defaults to Read-only: the agent browses, navigates and fetches freely, but anything that changes a site, a file or your machine waits for your approval. Three higher tiers — Browser auto, Browser auto + reads, Full auto — auto-approve progressively more. Raise it deliberately, and read Full auto as "any tool in this conversation may run without asking".

Tools the classifier doesn't recognize are always treated as highest-risk, so a newly added or third-party tool is never auto-approved below Full auto.

Upgrading from before v0.3.13: the old Auto-execute option never took effect, and resets to Read-only rather than becoming Full auto.

The tier is also what a remote-control session inherits — a paired phone can see the tier but cannot raise it.

Tool and command safety

• Canvas tools run through a whitelist: no shell, validated parameters, path confinement, output/time limits, and an audit log.
• Command auto-approval is governed by the [auth] section of config.toml, including an allowlist and patterns for sensitive files.
• Canvas artifacts run in a sandboxed iframe, and the bridge between page content and the browser is isolated.

Reporting a vulnerability

Please report security issues responsibly via the GitHub repository.