> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/vercel-labs/agent-browser/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Overview

> Security features for safe AI agent browser deployments

# Security Overview

agent-browser includes comprehensive security features designed for safe AI agent deployments. All features are opt-in, ensuring existing workflows remain unaffected until you explicitly enable them.

## Security Features

### Authentication Vault

Store credentials locally with AES-256-GCM encryption. The LLM never sees passwords - only profile names.

```bash theme={null}
echo "mypassword" | agent-browser auth save github \
  --url https://github.com/login \
  --username myuser \
  --password-stdin

agent-browser auth login github
```

[Learn more about Auth Vault](/security/auth-vault)

### Domain Allowlist

Restrict browser navigation and network requests to trusted domains, preventing data exfiltration.

```bash theme={null}
agent-browser --allowed-domains "example.com,*.cdn.example.com" open example.com
```

Blocks:

* Navigation to non-allowed domains
* Sub-resource requests (scripts, images, fetch)
* WebSocket and EventSource connections
* navigator.sendBeacon calls

[Learn more about Domain Allowlist](/security/domain-allowlist)

### Action Policies

Gate destructive or sensitive actions with a static policy file.

```json theme={null}
{
  "default": "deny",
  "allow": ["navigate", "click", "get", "snapshot"]
}
```

```bash theme={null}
agent-browser --action-policy ./policy.json open example.com
```

[Learn more about Action Policies](/security/action-policies)

### Action Confirmation

Require explicit approval for sensitive action categories.

```bash theme={null}
# Agent must get approval before running eval or downloading files
agent-browser --confirm-actions eval,download \
  --confirm-interactive \
  open example.com
```

[Learn more about Action Policies](/security/action-policies)

### Content Boundaries

Wrap page output in delimiters so LLMs can distinguish tool output from untrusted content:

```bash theme={null}
agent-browser --content-boundaries snapshot
```

Output:

```
---BEGIN PAGE CONTENT---
- heading "Example Domain" [ref=e1]
- link "Learn more" [ref=e2]
---END PAGE CONTENT---
```

This prevents prompt injection attacks where malicious page content tricks the LLM into executing unintended commands.

### Output Length Limits

Prevent context flooding by truncating page output:

```bash theme={null}
agent-browser --max-output 50000 snapshot
```

## Environment Variables

All security features can be configured via environment variables:

<table>
  <thead>
    <tr>
      <th>Variable</th>
      <th>Description</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>AGENT\_BROWSER\_ENCRYPTION\_KEY</code></td>
      <td>64-char hex key for AES-256-GCM encryption (generate with <code>openssl rand -hex 32</code>)</td>
    </tr>

    <tr>
      <td><code>AGENT\_BROWSER\_ALLOWED\_DOMAINS</code></td>
      <td>Comma-separated allowed domain patterns</td>
    </tr>

    <tr>
      <td><code>AGENT\_BROWSER\_ACTION\_POLICY</code></td>
      <td>Path to action policy JSON file</td>
    </tr>

    <tr>
      <td><code>AGENT\_BROWSER\_CONFIRM\_ACTIONS</code></td>
      <td>Action categories requiring confirmation (comma-separated)</td>
    </tr>

    <tr>
      <td><code>AGENT\_BROWSER\_CONFIRM\_INTERACTIVE</code></td>
      <td>Enable interactive confirmation prompts (auto-denies if stdin is not a TTY)</td>
    </tr>

    <tr>
      <td><code>AGENT\_BROWSER\_CONTENT\_BOUNDARIES</code></td>
      <td>Wrap page output in boundary markers</td>
    </tr>

    <tr>
      <td><code>AGENT\_BROWSER\_MAX\_OUTPUT</code></td>
      <td>Max characters for page output</td>
    </tr>
  </tbody>
</table>

## Configuration File

Security settings can also be configured in `agent-browser.json`:

```json theme={null}
{
  "allowedDomains": "example.com,*.cdn.example.com",
  "actionPolicy": "./policy.json",
  "confirmActions": "eval,download",
  "confirmInteractive": true,
  "contentBoundaries": true,
  "maxOutput": 50000
}
```

## Best Practices

### For AI Agent Deployments

1. **Always use domain allowlist** - Prevents agents from navigating to unexpected sites or exfiltrating data
2. **Enable content boundaries** - Protects against prompt injection attacks
3. **Use action policies** - Restrict agent capabilities to minimum required actions
4. **Encrypt credentials** - Store auth profiles with encryption enabled
5. **Limit output size** - Prevent context flooding attacks

### Example Secure Configuration

```bash theme={null}
# Set encryption key (one-time setup)
export AGENT_BROWSER_ENCRYPTION_KEY=$(openssl rand -hex 32)

# Create action policy
cat > policy.json <<EOF
{
  "default": "deny",
  "allow": ["navigate", "click", "fill", "get", "snapshot"],
  "deny": ["eval", "download"]
}
EOF

# Run agent with security features enabled
agent-browser \
  --allowed-domains "myapp.com,*.myapp.com" \
  --action-policy ./policy.json \
  --content-boundaries \
  --max-output 50000 \
  open https://myapp.com
```

### For Development

During development, you may want less restrictive settings:

```bash theme={null}
# More permissive but still safe
agent-browser \
  --confirm-actions eval,download \
  --confirm-interactive \
  open https://example.com
```

## Security Considerations

### Encryption Key Management

* **Auto-generated keys**: Stored at `~/.agent-browser/.encryption-key` with 0600 permissions
* **Manual keys**: Set `AGENT_BROWSER_ENCRYPTION_KEY` environment variable
* **Backup**: Keep a secure backup of your encryption key - encrypted data cannot be recovered without it

### Domain Allowlist Limitations

* Include CDN domains your target pages depend on (e.g., `*.cdn.example.com`)
* Wildcard patterns like `*.example.com` also match the bare domain `example.com`
* Data URI and blob URLs are allowed for sub-resources but blocked for navigation

### Action Policy Evaluation

If `eval` action category is denied by policy, page scripts cannot restore original WebSocket/EventSource implementations. For maximum security, always deny `eval` when using domain allowlist.

## See Also

* [Auth Vault](/security/auth-vault) - Credential storage and encryption
* [Domain Allowlist](/security/domain-allowlist) - Network restriction
* [Action Policies](/security/action-policies) - Action gating and confirmation