# Security

## Current Protections

- bearer token authentication
- outbound-only polling agents
- command allowlist
- isolated subprocess execution

## Recommended

- HTTPS everywhere
- short-lived credentials
- reverse proxy rate limits
- audit log retention
- separate operator and agent credentials
