openrabbit-node is a remote-control node client: by design it runs commands and reads/ writes files on your machine on behalf of the rabbit service you register it with. Understand this before running it.

• The node authenticates to the service with an ed25519 key (private.key, PEM/PKCS8) and connects over TLS WebSocket, with each connection proving possession of the key via a signed challenge. Only your registered node can receive commands for your node id.
• The control channel is trusted. Whoever can drive that channel (i.e. the rabbit service / your r1) can: run arbitrary commands, start background sessions, and read/write files — the same things you can do at a shell. That is what a node client is.
• Spawned commands inherit the node process's environment, including any secrets in it.

• OPENRABBIT_FILE_ROOT=<dir> — confine fileRead/fileWrite/listDir to a directory tree. Requests outside it are rejected. Defense-in-depth if the channel is ever abused.
• OPENRABBIT_DATA_DIR — keep the node identity + jobs in a location only you can read. The private key is written 0600.
• Run the node as a low-privilege user. It never needs admin.
• Do not commit private.key, connection.json, or quirks.json (they're gitignored).

Found a vulnerability? Please open a GitHub security advisory (or a private issue) rather than a public issue. This is a community project, not an official rabbit product.