Security

Treat the Brain host as a trusted runtime: MCP tokens and BYOA secrets live on disk under .eve/.

Product-level guardrails (workspaces, HITL approvals, Ask mode, agent safety posture) are described in Architecture and Instance policies.

Checklist

Secrets — Strong unique values for BETTER_AUTH_SECRET, BRAIN_BOOTSTRAP_TOKEN, and BRAIN_INTERNAL_TOKEN
Bootstrap — Require BRAIN_BOOTSTRAP_TOKEN in production; retire it from chat logs after first operator
Public origin — Keep BRAIN_PUBLIC_URL / BETTER_AUTH_URL exact (scheme + host) so cookies and OAuth callbacks stay correct
TLS — Terminate HTTPS at the reverse proxy; prefer ?sslmode=require for Postgres when off-box
Ports — Expose Next (:3000) only; keep eve (:4274) on loopback
.eve/ — Restrict filesystem permissions; include in backups; exclude from public artifacts
Signup mode — Prefer invite-only or SSO-only on shared hosts (Instance policies)
Agent safety posture — Leave Auto unless you intend Strict (more pauses) or Dangerous (fewer pauses). Auto/Strict also screen tool results before the model sees them; Dangerous live chats skip that. Command policy still blocks high-risk shell and SQL. Scheduled jobs still screen.
SMTP — Configure only if you need invite / forgot-password email; otherwise copy invite links
License secret — If using BRAIN_LICENSE_SECRET, store it with other host secrets
Sessions — Users can revoke devices under /settings/account; admins can reset passwords (signs out all sessions)