The part everyone skips

What we actually harden.

This is the whole reason to hire us instead of following a README. It is published in full, so you can check our work — or do it yourself, which is genuinely fine by us.

Why the default install is not enough

Self-hosted agent runtimes are remarkable software, and we recommend them. They are also young, and they optimise for getting you running in five minutes — which is not the same as getting you running safely.

As shipped, credentials are commonly written to disk in plaintext, including the token for every messaging account you connect. The management interface is easy to leave reachable from the internet. Extensions update themselves from the network. And prompt injection — hidden instructions in a page, an email signature, a calendar invite — remains an unsolved problem across the entire industry, not a bug in any one product.

Published advisories this year cover remote compromise and data exfiltration; one related breach exposed customer email archives from 41 organisations. Microsoft has published guidance on running these agents with proper identity and isolation. Several governments have restricted them on managed devices.

The conclusion is not "do not run an agent." It is that the twenty minutes the tutorial takes is not the work. The work is deciding what it may touch, closing everything else, and handing you something you can actually reason about.

Included in every setup, from $500 up

The hardening baseline

Not an upsell, not a premium tier. If we set up an agent, it gets all of this — otherwise we would rather not set it up.

Credentials

Keys out of plaintext: Model API keys and per-channel tokens are moved into the system keychain or a secrets manager. Nothing usable is left readable on disk.
Scoped tokens only: Every integration gets the narrowest scope that still works. No account-wide tokens where a read-only one will do.
Hard spend caps: Budget limits set at the provider, not just in config. A compromised or looping agent cannot quietly bill you four figures.
Rotation plan: You leave knowing which keys exist, where they live, and how to revoke each one without our help.

Isolation

Non-admin service account: The agent runs as a dedicated user with no administrator rights, not as you.
Sandboxed runtime: Containerised or otherwise confined, with an explicit list of directories it may read and write.
Never exposed to the internet: The management interface binds to localhost and your private network. Remote access goes over a private tunnel, never an open port.
Filesystem allowlist: It reaches the folders it needs for the work you asked for. Not your whole home directory.

Supply chain

Version-pinned runtime: We pin a known-good release. Updates are tested before they reach your machine, not applied automatically at 3am.
Skills allowlisted: Only reviewed extensions are installed, and skill auto-update is disabled — that is a live supply-chain path.
Reviewed before install: Anything third-party gets read before it runs with access to your accounts.

Blast radius

A written reach map: A plain-English document listing every account, folder, and capability your agent can touch. Most people have never been given one.
Confirmation on irreversible actions: Sending, publishing, deleting, and spending are gated on your explicit approval by default.
A kill switch you can reach: One documented command or click that stops everything. Tested with you during handoff, not just described.
Backed up first: Your machine is snapshotted before we install anything. Always.

Our own policy

We never take custody of your credentials.

A consultant who collects your passwords is a consultant who becomes a target. So we do not hold them, ever — and that is a policy you can hold us to, not a reassurance.

How we do it

You type your own credentials, on your own machine, on a screen share
Or you share them through your password manager, with access you revoke afterwards
Where a provider supports scoped keys, you create them and paste them in yourself
At handoff you rotate anything that was on screen — we walk you through it

What we will never ask for

A password over email, text, or chat
Your master password, recovery codes, or 2FA seed
Account-wide admin keys when a scoped one would work
Standing access to your systems between engagements

If anyone claiming to be us ever asks for something in the right-hand column, it is not us. Email us directly and check.

Straight answers

What we cannot promise

Hardening reduces blast radius. It does not make an agent safe in the way a calculator is safe, and anyone telling you otherwise is selling something.

Prompt injection is not solved. We reduce what a successful injection can reach — that is the honest framing — but no configuration available today eliminates the attack.
The model can be wrong. It will occasionally misunderstand you. That is why irreversible actions are gated on your confirmation by default.
New advisories will land. This software is young and moving fast. That is the honest argument for a maintenance retainer, and also a fine reason to learn to patch it yourself.
Some data should not go near it. If you handle medical records, client trust funds, or regulated financial data, we will tell you which parts to keep out of scope entirely.

Sources

We would rather you read the primary material than take our word for any of this.

Want this done to your setup?

The full baseline is included from the $500 personal setup upward. If you already have an agent running, we also audit existing installs hourly.

Book a strategy session See full pricing