What holds. What does not. How to check.

Supported deployment shapes

• A prompt-injected agent reading your secrets

  Credential files such as ~/.ssh, cloud credentials and the HQ config are refused for every tool, always. Shell commands start with an empty environment plus a short allowlist, and the OS sandbox masks config, env files and private SSH keys.

• Data leaving after untrusted content

  Once a session reads a web page, mail, a converted document, another agent's mailbox, a pane or a remote MCP result, project secrets and outbound network from bash are denied. Sub-agents share the taint, so delegating does not clear it.

• Server-side request forgery

  web_fetch refuses loopback, private, link-local and metadata addresses, checks every redirect hop and pins the resolved address so DNS rebinding cannot move it.

• A hostile web page talking to your local server

  An origin guard refuses cross-origin requests and unknown Host names, which stops DNS rebinding. Tokens travel only in headers, and the chat socket opens with a single-use ticket.

• A public MCP endpoint without a key

  /mcp refuses every request until a key is configured. Keys have scopes, and the gateway sets the scope itself.

• Tampered or replayed updates

  Releases and channel pointers are minisign-signed. The updater verifies hashes, rejects unsafe archives and lower sequence numbers, and rolls back on a failed health check. The build side holds no credential for any instance.

• The agent replacing its own binary

  Self-update tools are off by default. When on, installing needs an owner approval bound to the exact tree and binary hash.

• The first stranger to message your bot

  Chat relays no longer adopt the first sender as owner. You pair explicitly.

• Cross-person disclosure in shared chats

  Notes and tasks carry labels, and a shared channel sees only what every verified participant may see. Unknown identities get public content only.

• Coding agents being clicked through

  HQ never answers a trust dialog for you, and driving a session has mechanical limits that do not depend on the model deciding to stop.

• A personal agent reaching past its lane

  Hermes Agent and OpenClaw run in the same process sandbox as coding agents, with no HQ token and no MCP wiring. The default open profile walls off HQ itself, other agents' logins and your credential stores, and leaves them the machine's network. The strict profile adds an egress allowlist with no model provider on it until you add one. HQ refuses to give them code work, and their output goes to a person for review (or, with opt-in task verification, to an evidence check), never straight to done.

• 01

  The model itself.

  A refusal is a mitigation, not a boundary. The boundaries are the sandbox, the environment allowlist and the governance rules. A prompt injection that gets past those is in scope for a report. A model that merely behaves badly is not.

• 02

  The bash text checks.

  They catch honest mistakes and cheap tricks. Variables, string building, two-step commands and interpreter code can still get through, and the docs list the shapes. Without a working sandbox, you are relying on them plus the environment allowlist.

• 03

  The sandbox itself.

  HOME stays writable, so shell rc files can be changed and will run later outside the sandbox. The sandbox shares the host network unless you set network to false, and that cuts off gh and git from bash. On macOS, a bash child can still see the daemon's environment with ps.

• 04

  Coding agents HQ starts.

  A harness session is a separate program with its own shell. The host starts each agent from a clean environment and runs it in a process sandbox, but whatever you hand an agent (profile env values, wrapper scripts) is readable by a prompt-injected session. Keep secrets out of profile env.

• 05

  Personal agents HQ runs.

  Each keeps its own model provider key in its own state folder, which it can read, so a prompt-injected session can use it. HQ cannot cap their token spend. Give them a key with a spending limit set at the provider.

• 06

  The handoff key.

  It is equivalent to code execution on every host you paired. Bound it with agent_host.handoff_cwd_allow, and give it only to callers you would give a shell.

• 07

  An attacker who is already you.

  Anyone who controls the host user, the vault directory or the config file is out of scope. On loopback with no token set, any process on the machine can call the API without an Origin header, so set a token on shared machines.

• 08

  A stolen signing key, or a stale pointer.

  Both are listed as not mitigated by the updater. A compromised service user can also fake a healthy /health answer to defeat the automatic rollback. Locally built self-update binaries are not signed.

• 09

  Content already in the prompt.

  Vault text the context engine injects, and earlier turns in a thread, are not tracked as taint. Only tool results in the current session are.

• 10

  Independent review.

  HQ has not had an outside security audit. It is version 0.9.x. Treat it that way.

1. Download the manifest, its signature, the binary archive and the key.

   Download

   V=<version>   # for example 0.9.1, without the leading v
   B=https://github.com/CalvinMagezi/hq/releases/download/v$V
   curl -fsSLO "$B/manifest.json"
   curl -fsSLO "$B/manifest.json.minisig"
   curl -fsSLO "$B/hq-$V-linux-x86_64.tar.gz"
   curl -fsSLO "https://github.com/CalvinMagezi/hq/raw/main/release/minisign.pub"

2. Verify the manifest signature. It must report a good signature.

   Signature

   minisign -Vm manifest.json -p minisign.pub

3. Check each downloaded artifact against the hash in the signed manifest.

   Hashes

   jq -r '.artifacts[] | "\(.sha256)  \(.name)"' manifest.json | sha256sum -c --ignore-missing

4. On an instance, --dry-run repeats every check, including the channel pointer, and changes nothing.

   Dry run

   hq update --apply --dry-run

Channel pointers (channel-stable.json and channel-main.json) have their own .minisig. Only prehashed signatures are accepted, which is the default of minisign -S. Format and trust model: docs/UPDATE_SYSTEM.md.