Security policy
Browser-side SSH and the vault
SHAI’s web workspace performs SSH authentication and encryption in the browser. Saved sensitive connection data is encrypted locally before upload to the vault service. Passkey authentication and vault unlocking are distinct operations; supported unlock methods depend on the device and the account’s setup.
Browser-side encryption does not protect an unlocked workspace from malicious browser extensions, a compromised device, compromised application code, or an authorized guest who has been given control. Keep trusted devices and recovery material secure.
Routing and previews
Relay services require connection metadata and route encrypted SSH traffic. Hosted application previews handle HTTP traffic on the preview origin. Preview content, destination metadata, support information, and encrypted SSH payloads have different exposure and access properties.
A local or personal Connector runs on infrastructure you control. Its reach is governed by its authorization and network permissions. Only install it on trusted computers and review the networks it can reach.
Live collaboration
Owners choose what to share and whether to grant control. Guests can see and potentially copy permitted content; approved control can allow commands and file changes. Remove access when it is no longer needed, and treat guest access according to the sensitivity of the remote environment.
Reporting a concern
Contact SHAI support and ask for the private security-reporting channel before sending sensitive evidence. Provide a description, affected feature, safe reproduction steps, and the impact you observed. Redact credentials and other users’ information.
Do not test other customers’ accounts, exfiltrate data, disrupt service, send spam, perform destructive actions, or test third-party infrastructure without permission. If you encounter another person’s information, stop and report the circumstances. Request written permission before testing beyond an account and resources you are authorized to use.
Disclosure and scope
This draft does not create a bug-bounty reward, a response-time guarantee, or legal authorization to test systems outside your existing permission. A dedicated reporting address, scope, acknowledgement process, and disclosure terms should be confirmed before the final policy is published.