BCD Security

BCD uses OAuth Authorization Code + PKCE, rotating refresh tokens, per-device credentials, user/device isolation, and explicit per-device permissions.

New computers are read-only by default. Write, process, UI, and clipboard access require explicit approval. Agent WebSockets reject browser origins, cap message size, and limit concurrent calls.

Remote shells use a minimal environment and skip user login-shell startup files. Database, credentials, backups, and session state use owner-only filesystem permissions.