Skip to content

Security: seedpi867-cmd/seed

Security

SECURITY.md

Security — What Seed Can and Cannot Do

This file documents Seed's trust surface. Read it before running.

What Seed can touch

  • Its own filesystem under /home/seed/
  • The internet via HTTP (RSS, APIs, web search)
  • Its own GitHub repos (your-github-username/seed and seed-agent-os)
  • Its own website (your-seed-website.vercel.app via git push)
  • Email (IMAP read-only for your-email@gmail.com)

What Seed cannot touch

  • Other users' files or system directories
  • Root access (no sudo in the brain loop)
  • Payment systems, cloud infrastructure, production databases
  • Other people's social media accounts
  • Hardware beyond the Pi (no network devices, no attached peripherals)

What Seed cannot delete

  • /var/backups/seed/ — root-owned tamper-proof backups (every 6 hours)
  • The backup cron job (root's crontab)
  • The systemd service files (requires sudo)

Action classification

Action Classification
Read files in /home/seed/ Routine — no approval needed
Write files in /home/seed/ Routine — logged
Write blog posts Routine — deployed via git
Push to its own GitHub repos Routine — logged
Run shell commands Routine — within /home/seed/
Fetch URLs / web search Routine — for research
Read email (IMAP) Routine — read-only
Delete its own files Allowed but logged — backups exist
Modify its own code Allowed — self-improvement gate applies
Create external accounts Requires working credentials — not currently automated
Access other machines on the network Denied — no SSH keys to other hosts
Modify system services Denied — requires sudo
Access /etc/, /var/, /root/ Denied — wrong user
Send email Not configured
Spend money Not possible — no payment credentials

Input firewall

All external inputs (RSS, email, transcripts, visitor messages) pass through cognitive/firewall.py before reaching the LLM. Known prompt injection patterns are stripped. Attacks are logged to data/security.jsonl.

API exposure

The webserver exposes /api/ endpoints via Cloudflare tunnel. The /api/file endpoint is whitelisted to 7 safe paths only. API keys and tokens are redacted from all outputs via a server-side filter.

How to kill Seed

sudo systemctl stop seed-brain    # Stop the brain loop
sudo systemctl stop seed-web      # Stop the dashboard
sudo systemctl stop seed-tunnel   # Stop the tunnel

How to restore from backup

sudo seed-restore.sh              # List available snapshots
sudo seed-restore.sh 20260502_1800 # Restore from specific snapshot

Privacy

Seed does not publish its creator's name, email, phone, or personal details. It refers to its creator as "my creator" in all public content.

There aren't any published security advisories