How does Cambric AI ensure my data's safety?

Harpax is built around four safety principles: keep data local, expose nothing to the network that doesn't need to be exposed, sandbox anything user-supplied, and fail closed by default. Here's what each of those means in practice.

1. Local by default

Captured sessions, detections, rules, and configuration all live on your machine under ~/.harpax/. There is no Cambric-hosted backend that mirrors your session data. The daemon runs as a normal process under your user account and only has the permissions you have.

Because nothing is centralized, there is no Cambric data store that an attacker could compromise to gain access to your sessions.

2. Loopback-only network surface

The daemon binds three ports, and all three bind to 127.0.0.1 only. They are not reachable from your local network and they are not exposed to the internet.

• 127.0.0.1:9850 — WebSocket bridge between the GUI and the daemon
• 127.0.0.1:9851 — IPC channel for hook verdicts
• 127.0.0.1:9852 — MCP server for re-injecting allowed actions

The IPC channel uses a fixed identity handshake (a magic string baked into every Harpax binary) so the hook client can verify it's connecting to a real Harpax daemon and not some other process that happens to have grabbed the port.

3. Sandboxed rule execution

Custom JavaScript rules live in ~/.harpax/rules/ and are loaded into a sandboxed JS runtime with a hard execution timeout (default 10ms per rule). A misbehaving rule can't hang the detection pipeline, allocate unbounded memory, or read files outside its declared inputs.

Rules receive only the current event and a read-only view of session history. They cannot make network calls, spawn processes, or write to disk.

4. Fail closed

Several places in Harpax are designed so that a failure or ambiguous situation results in more safety, not less:

• Override auto-deny. A blocked tool call that doesn't get a human decision within 30 seconds is denied automatically. Walking away from the keyboard never silently approves an action.
• Hook timeout. If the daemon doesn't respond within the configured timeout, the hook returns an explicit signal — not a silent success.
• Allowlist matching. Allowlist entries use strict patterns (tool_name:glob_pattern); only exact matches pass through. There's no fuzzy fallback that could approve an unintended action.
• Passive mode is opt-out, not opt-in for blocking. Active mode is what enforces. You make a deliberate choice to enable it; you don't have to remember to keep it on.

What you control

Control	Where
Storage location for session data	storage.path in ~/.harpax/config.yaml
How long sessions are retained	retention.max_age_days
Whether sessions are deleted on session end	retention.cleanup_on_session_end
Which detection tiers are active	detection.tier2.enabled / detection.tier3.enabled
Whether the daemon sends alerts outbound	alert.* blocks (webhook, email)
Which patterns are pre-approved	~/.harpax/allowlist.yaml or the Allowlist panel in Settings

Operational practices

• Reproducible builds. Harpax binaries are built from the public source tree. The build commit and version are visible in harpax version and on the About row of the Settings page.
• Open detection rules. Every built-in rule lives in internal/detection/builtin/ with its references, severity, and known false positives in the open. You can audit exactly what triggers a block.
• Responsible disclosure. Security issues should be reported to [email protected] — see How do I connect with the Cambric team?

What this article does not claim

Some safety claims are outside the scope of what a local-first tool can guarantee, and Harpax doesn't pretend otherwise:

• Harpax doesn't encrypt your local session files at rest beyond whatever full-disk encryption you've already enabled on your operating system. If your filesystem is unencrypted, your Harpax data is too.
• Harpax doesn't protect against an attacker who already has user-level access to your machine. Once they're in your account, they have what Harpax has.
• Harpax doesn't prevent you from approving a dangerous action by clicking Allow. The override system is there to give you a decision point, not to second-guess your decision.