Please report security issues privately to the package author (leike0813@gmail.com) with a minimal reproduction. Do not open a public issue before a fix is published.

• The Phase 2 bridge is an authenticated local Unix socket at $DSH_HOME/ark/bridge.sock with an owner-only random token at $DSH_HOME/ark/bridge.token; both files are 0600 and the directory is 0700.
• The token is a host-instance credential for the local OS user, not a per-session secret. Any process with the same OS-user privileges can, in principle, read the token and address any live session in that dsh host.
• dsh-ark's isolation guarantee is between dsh instances (DSH_HOME values) and correct routing of normally injected DSH_SESSION_ID/DSH_ARK_MODE values. It is not an adversarial security boundary between sessions of the same OS user inside one host. See docs/phase2/session-binding.md.
• Never publish a bridge.token value, and do not widen the permissions of $DSH_HOME/ark or the generated $DSH_HOME/.agent-presets shellrc files.