# Security

> What nmbr protects, what it deliberately does not, and what is on you — read before giving an agent real powers.
>
> Markdown mirror of https://nmbr.ai/developers/docs/security/ — part of the nmbr Agent API docs (https://nmbr.ai/developers/docs/). Spec: https://nmbr.ai/developers/openapi.yaml · Site index: https://nmbr.ai/llms.txt

## Honest positioning

nmbr is a **closed network with encryption at rest**, not an end-to-end-encrypted messenger for agents. Messages are AES-256-GCM encrypted at rest and decrypted only inside nmbr's servers — and, for your agent, sent in plaintext to whoever holds its token, on infrastructure you chose. That egress is deliberate, limited to 1:1 conversations with people who added the agent, and recorded. There is no ad business reading it, and agent tokens are stored hashed. But if your agent runs on a machine you don't control, the conversations it sees run through that machine. Choose accordingly, and tell the people who add your agent.

## What the platform enforces

- **Token class separation.** An agent token opens only `/api/agent/v1/*`; human sessions and tokens are refused there. Agents have no interactive sign-in at all.
- **No self-replication.** Agents are created only by humans in the app; there is no create endpoint and no token-minting endpoint on the agent surface.
- **Contact-gated reach.** An agent can message only people who added it; they can remove or block it.
- **Approvals bound to a person and a conversation**, fail-closed on expiry, capped per conversation. See [Approvals](/developers/docs/approvals/).
- **No automatic link previews for agent-sent URLs.** Links from an agent render as "tap to preview" — the server never fetches a URL an agent sent until a human asks. This closes the zero-click exfiltration vector seen on other platforms, where a prompt-injected agent leaks data through a URL the preview-fetcher requests.
- **Webhook hygiene.** HMAC-signed deliveries with timestamps (replay window 5 min), secret rotation with an overlap window, SSRF protection with DNS pinning on nmbr's side.
- **Rate limits and ceilings** per agent and per recipient; a looping agent degrades, it doesn't flood.
- **Kill switches.** Revoke one token or all of them in the app; suspending an owner cuts off every agent they own on the next request.

## What is on you

- **Prompt injection.** Everything your agent reads — messages, voice transcripts, shared documents — is untrusted input. Give the agent the minimum capabilities, put every consequential action behind an [approval](/developers/docs/approvals/), and never let it act on a proposal it hasn't seen approved.
- **Token hygiene.** Treat `agent:` tokens like passwords: environment variables or a secret store, never in code or logs; one token per deployment; revoke on any doubt. Rotate the webhook secret if it's ever exposed.
- **Verify webhooks** on the raw body before doing anything with them.
- **Approval prompts are for people.** Keep secrets out of `title`/`description`; they render on a phone and appear in chat previews.
- **Your machine.** The agent's host sees plaintext. Disk encryption, updates and access control there are part of your users' privacy.

## Reporting

Security issues: [support@nmbr.ai](mailto:support@nmbr.ai?subject=Security%20report) — please include "security" in the subject. We do not run a public bug bounty yet.