#Security

reins has no cloud half. The CLI, the daemon and the extension only talk to each other, on your machine.

##Network

• Everything binds 127.0.0.1. Nothing is reachable from the network.
• The daemon checks the Host header, so a web page cannot reach it through DNS rebinding.
• It accepts only allowlisted chrome-extension://<id> origins. Chrome sets that header itself, so pages and other extensions cannot fake it.

##Seeing and stopping it

• Chrome shows its "is being debugged" banner on any tab reins is attached to.
• Disconnect in the toolbar popup cuts the connection at once.
• The extension acts only on commands from the CLI. Nothing runs in the background.

##Site permissions

Every site is deny, read or full, checked inside the extension before any command runs. Only a click in the popup can grant more; the CLI can only tighten. The default is full everywhere, so this is opt-in.

→How site permissions work

##What it does not protect against

The tiers contain the agent you invited in. They do not stop other software running as you, which could talk to the daemon or edit the policy directly. The threat model covers this, prompt injection, and a hardening checklist.

##Audit trail

Every command, and every one policy blocks, adds a line to ~/.reins/logs/audit-YYYY-MM-DD.jsonl. Typed text, fill values, eval code and CDP payloads are redacted, so the log shows that the agent typed, never what. Files are deleted after 30 days. reins audit shows the trail; --denied shows only blocks.

##reins do and TypeSafe

reins do is off until you save a TypeSafe key (reins key set typesafe). While a run is working, the daemon sends this to api.typesafe.ai, under your account:

• your goal and your --fill values
• the tab's URL and title
• visible text, up to about 6,000 characters
• labels and values of the page's controls
• the run's last 10 actions

Password, file and hidden inputs are never sent. The key lives in ~/.reins/credentials.json (mode 0600) and is never printed, logged or sent to a page.

Jev can only pick from elements reins read off the page. To limit what a page can talk it into:

• Clicks labelled with words like buy, pay, send or delete stop the run unless you pass --confirm or the goal names that label. Unlabelled buttons stop too. It matches English words, so it is not a guarantee.
• Leaving the site stops the run (left_site). Site permissions apply on every step.
• Ctrl-C, --timeout or a daemon restart stops it before the next action.
• reins re-checks each element right before acting, but a page can still swap what sits under it. Use --confirm for anything you would not click blind.

##Data

No analytics, no telemetry, no remote code. Page content goes only to your local daemon, unless you opt in to reins do. The extension stores its settings and your site policy in chrome.storage. Full policy: reins.tech/privacy. Source: github.com/karnstack/reins.