Security

Automata reduces the authority given to an AI client, but operators still control the upstream credentials and infrastructure that define the ultimate boundary.

Credential boundaries

Keep browser sessions and MCP authentication separate. The web UI uses an HTTP-only PocketBase session cookie; MCP requests use connector tokens only.

Evolution global keys provision instances, while normal WhatsApp calls use per-instance tokens. The Telegram administrator key provisions sessions, while normal calls use per-session credentials. Do not add a fallback from a missing per-connection key to a global key.

Connector tokens

Raw connector tokens are shown once and stored only as SHA-256 hashes. Automata redacts /mcp/<token> paths and authorization headers from its own error paths, but operators should still prefer bearer headers and ensure proxy logs do not capture secrets.

Issue separate tokens per client, choose expiries, scope narrowly, and revoke any token exposed in chat, support tickets, logs, or source control.

Database roles

Use least-privilege roles for both user database connections and Evolution message reads. Tool plan checks cannot see everything triggers or user-defined functions may do, and a superuser can bypass normal database restrictions.

Grant only required schemas, tables, and statement types. Keep run-statement off unless the workflow truly requires writes.

Network protections

The outbound host guard blocks private and loopback targets by default and always blocks Automata internal services. Leave NUXT_ALLOW_PRIVATE_TARGETS off for shared environments.

Set NUXT_WEBHOOK_SECRET. Evolution does not sign webhook payloads itself; Automata registers per-instance webhooks carrying this shared header, then treats each delivery as a prompt to re-read live state rather than trusting payload state.

Do not expose Evolution, Redis, messenger databases, bridge administration, or PocketBase administration publicly unless protected by an additional trusted network boundary.

Storage and backups

PocketBase hidden fields are hidden from API responses but are not automatically encrypted in pb_data. Set PB_ENCRYPTION_KEY, restrict backup access, and remember that backups may include connection strings, Evolution keys, and SMTP credentials.

Telegram sessions are encrypted with TELEGRAM_SESSION_ENCRYPTION_KEY. Store the key separately from database backups and preserve it through deploys. Restrict access to the Evolution instance volume because it holds active WhatsApp pairings.