Security

Nothing in the middle

There is no Muster server. No account, no session, and no database holding what your agents tried to do. The failure mode that worries us most, a company sitting in the middle of your terminal, is absent rather than promised.

Pairing

A device is paired once, from a window you open on the Mac itself, within two minutes. The Mac issues a random bearer key that the device keeps in its Keychain, and every later request carries it. Keys are compared in constant time. An unpaired device on your network is refused, and a revoked key stops working the moment you revoke it.

The pairing window can only be opened from the Mac’s own loopback interface, so nothing on your network can ask the Mac to start trusting it.

Away from your desk

Each message is sealed with AES-GCM under a 256-bit key generated at pairing and held only by your Mac and your paired devices, then posted to a random 160-bit topic on a public notification relay. Three interchangeable relays mean one going down does not take your wrist offline. Replayed and stale messages are refused by timestamp, and the link is rate limited. The relay is optional and can be switched off.

How far it reaches

The sentence you read is written to be readable, which makes it the wrong thing to judge risk from. So reach is worked out separately, on the Mac, from the literal command and its arguments, before any sentence exists.

• Contained. This Mac can put it back. The only kind a standing rule can answer.
• Spreading. Hard to take back, usually because someone else will see it. Always asks you.
• Permanent. Cannot be undone, such as rm -rf, git push --force or a script piped from the internet into a shell. Asks every time, and needs a deliberate hold, never a single tap.

A command the classifier cannot place is never called contained. Absence of evidence is not evidence of safety, and tests for this run on every build.

The ask link

A link you can give someone lets them ask you something. It has its own topic and its own key, and it works in one direction only: a holder can raise a question, but never answer one or read your state. Its secret rides in the part of the address browsers do not send to servers. Rotating it stops every copy.

Reporting something

Email hello@auteurhq.com with what you found. We will reply within three days, and we will not threaten anyone who reports in good faith. If a fix changes what leaves your machine, the release note will say so in its first line.

What we do not claim

Muster is a small independent product in beta. It has no third-party audit and no compliance certification, and we would rather say so here than imply otherwise. What it has is an architecture with little to attack: no server, no account, and no plaintext leaving your Mac.