Web Terminal gives the browser a real bash PTY on the machine that runs the Node server. There is no application-level authentication.

Email dreamproject-ai@proton.me with enough detail to reproduce the issue. Do not open a public issue for unfixed remote-code or exposure flaws.

• Run the server only on localhost or a network you trust.
• Do not publish the port to the Internet.
• Remember that identity masking is cosmetic: command output can still leak the real username, hostname, or home path.
• Keep .env private; it is ignored by git.

This line is a closed maquette (version 1.1). There is no regular hardening roadmap. See the README status note and the official project page.