Lumen
Security

Local gateway security

Bound the future loopback bridge to approved roots, methods, origins, and a scrubbed child process.

Outcome

The future personal bridge can access an approved local project without exposing local credentials or an inbound cloud-reachable port.

Prerequisites

The local-gateway slice must exist and pin a compatible CLI protocol. Until then, no gateway process or network endpoint is part of Lumen.

Steps

  1. Bind only to loopback and require the exact approved Host and browser Origin.
  2. Store a rotatable per-install secret in OS-protected credential storage.
  3. Launch the child over stdio with a minimal environment and positive method allowlist.
  4. Resolve every approved root and file-bearing path with realpath; reject symlink escapes before and after creation.
  5. Normalize allowed events into product contracts and preserve user approvals.
  6. Use an outbound authenticated bridge when a cloud API needs local capability.

Verify

Reject unknown methods, bad origin/host, replayed secret, unapproved root, symlink escape, scrubbed secret canary, and destructive thread/config/auth actions. Kill and restart the gateway and confirm a clear recoverable state.

Recover

Use the adapter kill switch, rotate the install secret, stop the child process group, and inspect local logs for exposure. Do not expose the experimental network transport as a shortcut.

Next task

Use the generated reference.

Verify artifacts

Promote hostile uploads only after trusted streaming validation and tenant-scoped create-only storage.

Reference

Use generated HTTP, configuration, identifier, state, event, limit, and CLI contracts.

On this page

OutcomePrerequisitesStepsVerifyRecoverNext task