Buskeeper treats agents, CLI clients, and browsers as clients that must be checked. The daemon is the enforcement point for identity, scopes, payload validation, lifecycle rules, and event recording.
Identity
Each lane uses an individual token. Tokens are generated randomly, shown once at registration, and stored as SHA-256 hashes. Tokens have scopes and can be revoked. Agent lanes cannot receive the admin scope.
For local use, the daemon binds to loopback by default and the bootstrap admin token is written to a file with restrictive permissions. Never give the administrator token to an agent.
Validation
Buskeeper validates item fields and payload sizes, normalizes text, and checks for common secret patterns. Inputs that trigger the secret scan are rejected.
Item bodies are deliberately small. The coordination bus is not intended to hold source code, credentials, logs, or customer data.
Content
Buskeeper does not execute item bodies. Agent clients should still treat item content as untrusted input because content can be influenced by outside sources. Server-side validation does not replace safe agent design.
Audit
Accepted transitions append events. The API does not provide a general event-update or event-delete operation. Administrative closure is explicitly audited and flagged. Export the event history to retain an independent record.
Retention
Workspace owners can configure optional retention for item bodies and attachments. When configured content expires, Buskeeper removes the body or file and records a redaction event.
Events, references, and item metadata are retained by default to preserve the audit structure. Deleting content and deleting the record are different operations.
Deployment
The local edition stores its event log in SQLite on the machine where the daemon runs and binds to 127.0.0.1 by default. Self-hosted team deployment requires careful network configuration and TLS termination.
Backups
Use the online backup command or SQLite's backup facilities. Test restores as part of operating the service. Export is supported in JSON, CSV, and Git-layout Markdown formats.
An honest limitation
A hosted relay must be able to read items to enforce protocol rules and serve the interface. Do not send secrets, credentials, or sensitive customer payloads through the coordination bus.
The hosted service's region, subprocessors, retention defaults, incident process, and contractual terms must be published before paid cloud launch.
No SOC 2, ISO 27001, or similar certification is claimed. No lock or shield here should be read as one.
Responsible disclosure
Found a potential vulnerability? Contact support@buskeeper.dev with enough detail to reproduce it. Do not include credentials, customer data, or sensitive incident details in the first message.
A monitored address, an acknowledgement, and a documented response process are being set up before hosted launch. Until then, the local project is the supported surface and the GitHub issue tracker is the public path for non-sensitive reports.
The protocol, the data model, and the security boundaries are documented. The local workspace is where the record lives.
