SharetoBoardProtected assets
- Poppy API credential
- Private board/chat content
- Conversation integrity and history
- Board/chat destination policy
- Audit metadata and release evidence
Tentaclaw security and incident manual.
Protect the account-wide Poppy credential, restrict destinations, minimize content, treat returned material as untrusted, and keep release evidence separate from assumptions.
Assets and trust boundaries
Boundaries
- Human ↔ agent conversation
- Agent/skills ↔ MCP client
- MCP client ↔ Tentaclaw process
- Tentaclaw ↔ local secret store
- Tentaclaw ↔ Poppy API
Primary threats and controls
| Threat | Primary control | Residual risk |
|---|---|---|
| Credential enters agent context | Human-managed local key file; no key in skill/config/chat | Host/process compromise can still read it |
| Wrong board or chat | Exact resolution plus server allowlists | Incorrect allowlist configuration |
| Prompt injection in board content | Skills treat output as data and forbid operational obedience | Model may still mis-handle persuasive content |
| Overbroad enumeration | Task-need rule and filtered destination policy | Discovery tools retain account metadata authority |
| Redirect or destination substitution | HTTPS allowlist, no embedded credentials, redirect denial | Trusted upstream compromise |
| Oversized/slow response | Request/response limits, timeout, bounded retries | Upstream resource consumption within limits |
| Sensitive logging | Metadata-only audit events and redacted errors | MCP client may independently log tool payloads |
| Unapproved conversation writes | Distinct tools, history off by default, skill workflow rules | Client with tool authority can still invoke writes |
Data handling
- Tentaclaw does not persist prompts or Poppy responses by default.
- Candidate audit events contain destination host, method, API path, status, outcome, and latency—not prompt or response bodies.
- The surrounding MCP client must also be configured not to retain sensitive tool payloads.
- Use optional board/chat allowlists and send the smallest necessary
additional_context. - Poppy receives the request and applies its own service, retention, usage, and account policies.
Credential rules
Never: paste the key or a credential-bearing URL into chat; put it in a skill, source file, shell argument, browser extension, committed JSON/TOML/YAML, screenshot, support ticket, or ordinary log; ask the agent to read the key file.
The v0.3.0 candidate checks key-file permissions, ownership, and symlink behavior on POSIX. Windows operators must enforce ACLs separately. Where available, use an OS credential store, container secret, or vault integration reviewed for the deployment.
Suspected exposure response
- Stop access. Shut down the MCP client and Tentaclaw process.
- Rotate at the source. Revoke/reissue the Poppy key. Do not merely move the exposed value.
- Preserve minimal evidence. Record time, host, client, version, tool, and safe error metadata without copying sensitive content.
- Remove exposed artifacts. Delete or sanitize chat exports, workspace files, shell history, logs, screenshots, and source-control entries according to their platform procedures.
- Review scope. Determine which boards/chats the account-wide key could reach and whether conversation writes or credit consumption occurred.
- Rebuild trust. Create a new protected key file, restore allowlists, and validate with a disposable destination before production.
- Report product defects. Send a minimal report to security@sharetoboard.com without including the key or private content.
Security non-claims
- Tentaclaw does not protect against a compromised host user with arbitrary process/file access.
- Skills do not make retrieved content trustworthy.
- The candidate is not a customer identity, entitlement, billing, throttling, SIEM, or multi-account control plane.
- Automated tests do not prove live Poppy behavior or client acceptance.
- No public security certification or external audit is claimed.