Security

Security

Richmack Browser uses a local-first security model.

Browser security

Richmack uses upstream Chromium rather than disabling browser security updates.

Backend binding

The backend defaults to:

127.0.0.1:8765

This prevents normal LAN/public access.

Container isolation

Intended hardening includes:

• non-root process where possible
• read-only filesystem where practical
• dropped Linux capabilities
• no-new-privileges
• dedicated download volume
• no Docker socket mount
• resource limits

Webpage isolation

Page JavaScript does not receive direct shell or Docker control.

Automation

Automation should:

• operate only after explicit user intent
• provide preview where practical
• use action caps
• use delays
• provide stop behavior
• avoid storing password values
• stop or yield on consequential final actions