Agent Warden
Sign inInstall free
Documentation menu

Security and data

Sites call the hub; the hub never calls sites#

A connected site sends a signed report to the hub every five minutes and applies the instructions in the signed answer. The hub has no way to reach into a site, run code on it, or read its database. Every instruction goes through the same checks as the site's own admin screens, as the administrator who connected the site.

What a site sends#

Metadata and counts only:

  • plugin, WordPress, and PHP versions, the site's plan, and whether agents are paused;
  • the site's time zone;
  • each agent's name, status, and a fingerprint (hash) of its policy;
  • actions waiting for approval: agent name, ability, summary, and times;
  • daily counts of actions, refusals, holds, and undos for the last 7 days;
  • results of instructions the hub sent.

Posts, orders, customers, and what agents sent or received are never included.

Keys and signatures#

  • When you connect, the site creates its own Ed25519 key pair. Its private key is encrypted at rest on the site and never leaves it. The hub stores only the public key.
  • Every request from the site and every answer from the hub is signed, with a timestamp and a single-use nonce, and bound to the request it answers. Old or replayed messages are refused.
  • The pairing code never reaches the hub's database: the site sends only its SHA-256. The code travels to the claim page in the link's fragment, which browsers do not send to servers.
  • Both sides show a fingerprint of the two public keys, so you can confirm the site and the hub are talking to each other before you connect.

Plans from the hub#

A plan statement from the hub counts only when its signature matches a hub key the site trusts: the official hub keys built into the plugin, or keys an administrator adds with the AGENTWARDEN_HUB_TRUSTED_KEYS constant (for self-hosted and development hubs). A statement names the site's own key, expires after 72 hours, and is checked again every time the plan is read.

In the hub#

  • Passwords are hashed with scrypt. Session and invitation tokens are stored only as hashes.
  • Every action checks the member's role in one permissions table.
  • Payment webhooks are verified against Dodo's signature before anything changes, and each delivery is applied once.

Report a vulnerability to the address on the security page; do not open a public issue.