Security
Security and trust boundaries
A plain-language summary of how MUON treats custody, authority and evidence, including what is shipped today and what is still open.
The posture
Eight boundaries, stated with their limits
This page describes product posture, not a certification.
01
Local by default
MUON runs on your machine. Mission data, memory and activity stay local unless you choose to export them. MUON does not take custody of your Claude, Codex, Cursor or OpenCode logins.
02
People approve what matters
Sensitive edits, shell commands and shipping wait for a person by default. Full Auto is an explicit, per-agent standing consent you can revoke at any time, and every automatic approval is recorded. It cannot cover everything: egress and review-blind merges still ask, always.
03
A trail you can inspect
Approvals and key decisions keep identity and request context where the product supports it. Activity history is append-only. A full enterprise audit export surface is still being completed.
04
Secrets stay out of logs
Diagnostic paths scrub tokens and key-shaped strings before they hit logs or CI. Builds fail if secret-handling code logs the wrong way.
05
The dashboard has its own boundary
Clerk manages the production website browser session and connected GitHub account. When the dashboard needs to verify identity, MUON retrieves the connected GitHub OAuth token from Clerk server-side and sends it only to GitHub and MUON's registry for that account action. The token is not exposed to browser JavaScript or stored in a MUON-authored browser cookie on that path. A deployment explicitly running without Clerk may instead use MUON's legacy GitHub PKCE flow. Its sealed HttpOnly session expires after at most seven days, can expire earlier with the upstream GitHub token, and clears on sign-out. Account requests are no-store, seat mutations require the same site origin, and the registry re-verifies GitHub identity before every billing read or write. Browser checkout success is never entitlement authority — a bound, signed processor webhook is.
06
What is not claimed yet
MUON does not claim SOC 2, ISO 27001 or a finished third-party penetration test for current early releases. Internal adversarial tests cover refusal paths and containment; they are not a substitute for external attestation.
07
Shared responsibility
You keep AI tools updated, protect operator access and review approvals. MUON is responsible for narrow permissions, memory boundaries and failing closed when authority cannot be verified.
08
Vulnerability disclosure
Report security issues to [email protected]. We aim to acknowledge within 3 business days and share a remediation timeline within 14 days for confirmed issues.