Honest claims & reporting

The canonical list of what damn.dev never claims, the line between sovereignty and containment, and how to report a security issue.

This is the guard-rail page. Everything else in the docs is held to it.

What we never claim#

  • That the standard install is "fully contained." Containment of the standard install is platform-dependent and we state the per-platform ceiling honestly. Full containment is available as an enterprise capability, we're clear about which tier you're on.
  • "Kernel-contained" or "egress-blocked" on install paths where the OS sandbox isn't engaged. Containment is platform-dependent; where it isn't kernel-enforced we say so, and the enterprise tier delivers full containment identically everywhere.
  • That damn.dev contains, observes, or controls an AI worker it doesn't run. For external workers we record what's declared or observed, never enforced.
  • That a cooperative gate is containment. The coding and MCP gates are best-effort, fail-open, and bypassable: they govern a cooperating agent on a tamper-evident record, not a cage.
  • "Billing-grade" cost. AI usage cost is estimated, with bounded coverage and best-effort attribution.
  • That audit integrity protects the host. Tampering is detectable; the log doesn't make a host with full access immune.

Sovereignty vs. containment#

The one distinction to keep straight:

  • Sovereignty: your data never leaves your perimeter, is architectural and always true, on every platform and install path.
  • Containment: physically stopping an agent from reaching something, is platform-dependent on the standard install, and we name the ceiling every time (see Shell execution). The enterprise tier closes it with allow-listed egress, scoped credentials, and disposable execution.

Enforced vs. trusted, in one line#

damn.dev enforces the boundaries between members and between workspaces, gates consequential actions, and keeps a tamper-evident record. It trusts the host machine, the agent runtime's mounts, operators, and (for self-hosted installs) network transport. Neither half is hidden, see Enforced vs Trusted.

Reporting a security issue#

Found something? Email hello@damn.dev with the details and steps to reproduce. As the deployer you also own the operational duties that keep your instance safe, chiefly backing up secrets.key off the host, and securing transport on local and desktop installs.

Next#

Previous← Isolation, auth & secrets