# Security

What 0bridge can and can't read, and how your logins and keys are kept.

## What the server can read

- **Service logins.** The OAuth tokens and API keys of services you connect are stored encrypted, with a key per user, and used only to call those services for you. The server has to read them to make the calls.
- **Conversation history,** if you turn it on (`0b history on`), so your coding agents can search it. Chat apps can search it only while Chat history is on (see below). With `0b history mode e2e` it's sealed with your vault key and only your machines can search it.
- **Your profile, instructions, skills and memory,** so chat apps can read them. Unlike end-to-end history, these aren't sealed.
- **Agent tasks,** if you use agent control: the prompts, what the agent prints and its permission requests, for the task page.
- **Session states,** if hooks are on: the tool, repo, branch, machine, state and up to two short lines of text per session (your prompt's first line, the agent's notice, its last answer line), for the session board. Values from your vault and key-shaped text are hidden first. With end-to-end history, no lines or titles are kept, and your machines stop sending them once the server says so. Ended sessions go after a day, idle ones after 3 days, anything after 7: [Session board](/docs/sessions).
- **Drive files,** so AI apps can search and read them. Text in PDFs, Office files and images is extracted by Cloudflare Workers AI and kept next to the file, so search finds it. A scan warns about things like resident registration and card numbers; it never blocks a file. Old versions are kept so you can restore them: [Drive](/docs/drive).
- **Mail sent to a Drive folder's address,** with its attachments, while it waits in the Inbox, and the original message for 30 days.
- **Webhook events** you set up, with their bodies, so they can be routed and read. Kept 7 days by default, 30 at most, and not sealed: [Triggers and webhooks](/docs/triggers).
- **Token counts,** per session, model and hour, with the repo's name, if history or `0b usage on` is on. Counts only, never text. They stay readable by the server even with end-to-end history, so it can add them up: [Usage](/docs/usage).
- **Sign-in requests** from a machine that named your email: a hash of the email, the machine's name and system, and the country, until the request expires: [Approvals and sign-in](/docs/approvals).
- **Feedback reports** you or your agents send (the dashboard's Feedback button, `0b feedback`, `bridge__feedback`): what was written (a summary, details, steps, expected and actual results, commands and error messages), the versions included, the page and browser if you leave that on, and log lines only if you add them with `--include-logs` after seeing them. Each records where it came from (dashboard, CLI or which app), your account and the time. Key-shaped text is masked on the server before it's stored, and the team gets an email with it. They're kept with your account: [Send feedback](/docs/feedback).
- **An early-access request,** if you join team early access: the team's name and size, the AI tools it uses, what you want to do and a work email if you give one, until you withdraw it.
- **Activity, briefly.** The audit log keeps sign-ins, changes to tokens and connections, and each tool call's name, result and time (with a short error message when a call fails); not what was sent or what came back. It's deleted after 90 days; encrypted backups can hold it up to 12 weeks longer.

## What it can't read

- **Conversation history in end-to-end mode** (`0b history mode e2e`): encrypted on your machine with a key only your devices hold; only your devices can search it.

## Signing in

- Sign in with an email code, Google or GitHub. Add a passkey under Settings.
- Approving a new device, giving an app access and creating a token need a sign-in from the last 10 minutes, with your passkey if you have one. Adding or removing a passkey needs your passkey when you already have one.
- A machine can ask you to approve it. Only the dashboard can approve a sign-in, after you check its code on the approval page (or, when the machine named your email, pick its number on Approvals) and confirm it's you (your passkey if you have one); no device token, CLI command or chat app can: [Approvals and sign-in](/docs/approvals).
- Each machine gets its own token. The server keeps only a hash of it, signing out revokes it, and Settings → Devices revokes any of them.
- Recovery codes (ten, each used once) replace a lost passkey.

## Claude, ChatGPT and other apps

- Apps connect with OAuth 2.1 and PKCE. The consent screen shows the app and where it sends you back to, and their tokens only work for your 0bridge endpoint.
- Apps can call your tools; they can't add keys or tokens.
- Three switches decide how much a chat app reaches: **Chat history** (your coding-session history), **Agent control** (your agents) and **Webhook events in chat apps**. New accounts start with all three on; an account from before 2026-10-06 keeps what it had. Turning one on is only on the dashboard and needs you to confirm it's you. Turning one off works from anywhere, any connected AI included: `bridge__settings_off`, or `0b settings off <name>`.
- Coding-session history is never offered through a connector directory listing or the review account, whatever the switch says.
- Agent control also needs `0b agent on` on each machine, for the repos you allow.
- A webhook's data is untrusted: a command gets it only on its input, and a listening session gets it marked as outside data.
- Remove an app in the app itself: [Claude and ChatGPT](/docs/apps). Its access tokens expire within an hour.

## Drive folders and mail

- AI apps can't change a folder's instructions directly. When one writes or deletes `AGENTS.md`, `CLAUDE.md`, a skill under `.agents/skills/`, `.claude/` settings, `.mcp.json` or a similar file through the Drive tools, the change waits as a proposal that the workspace's owner (or, in a team, an owner or admin) applies in the dashboard. The same goes for team members who aren't admins, and for mail.
- A folder synced with `0b drive sync` on an owner's or admin's machine is theirs: whatever changes its files there, a coding agent included, goes up directly on the next sync and reaches the others' copies. Check what an agent changed in a synced folder's instructions before it syncs. Instruction files that no owner or admin approved never come down to a synced folder, and one person's `.claude/settings.local.json` and `CLAUDE.local.md` never sync.
- Files an app wrote, and all text extracted from PDFs, Office files and images, reach AI apps marked as data, not instructions. Only instructions saved by the owner or an admin go out as instructions.
- Mail to a folder's address is filed only when it comes from a member's address and its DKIM signature, which 0bridge checks itself, matches the sender's domain. Anything else waits in the Inbox until an owner or admin accepts it. The address can be changed or turned off at any time.

## Webhooks that run a command

- A webhook that runs a command runs one you saved on your machine with `0b webhook run`. The server never sees the command, its folder or its output: it knows the machine's name and system, which webhooks it has a command for, with their timeout and debounce, and the machine a webhook is pinned to (`--machine`), and gets back the exit code, how long it took and a short reason. The event reaches the command on its standard input, never through a shell.
- A webhook starts at most 500 runs a day, and at most 100 wait for a machine that's offline; more are dropped and listed with the reason. A run that times out is stopped with everything it started.

## What we're still working on

- A machine's token can do most of what your account can; it can't create other tokens or use production values without your approval. App tokens you mint on the dashboard can be narrower: read-only tools, no history, no agent control, an expiry. A project's token only opens that project.
- Agent control relays your agents' permission prompts to you and denies the dangerous ones by default. It is new: start with one repo and the default mode.
- Revoking Claude's or ChatGPT's access from the dashboard isn't there yet; remove it in the app.
- Tool descriptions from the services you connect reach your agent as those services wrote them. Treat an unfamiliar MCP server like any code you'd run.

## Report a problem

Use the [contact form](/contact?topic=security) with Security report as the topic. It goes privately to the team, and security reports get an answer first. Send security problems there rather than as [feedback](/docs/feedback), and leave passwords, keys and tokens out of them.