{
  "name": "security-and-safety",
  "description": "How to use WebX11 security levels, command blocking, and safety features",
  "tags": [
    "security",
    "safety",
    "blocking",
    "permissions"
  ],
  "category": "system",
  "created": "2026-06-22T19:02:49.950Z",
  "updated": "2026-06-22T19:02:49.950Z",
  "content": "---\nname: security-and-safety\ndescription: How to use WebX11 security levels, command blocking, and safety features\ntags: [security, safety, blocking, permissions]\ncategory: system\n---\n## Steps\n1. **Security levels:**\n   - security-level <0-3> — set security level:\n     0 = Permissive (no blocks, no confirms — anything runs)\n     1 = Standard (unknown cmds → AI route, destructive → confirm, system → block)\n     2 = Paranoid (unknown cmds blocked entirely, destructive blocked)\n     3 = Audit (everything allowed, everything logged)\n   - Default: level 1\n   - security — show current level, blocked count, and stats\n\n2. **Command control:**\n   - cmd-allow <cmd> — whitelist a command from security checks\n   - cmd-deny <cmd> — blacklist/block a command entirely\n   - whitelist built-in: help, clear, ls, cat, pwd, whoami, df, free, top, ps, echo, date, env, history\n\n3. **What gets blocked at each level:**\n   - Unknown commands: Level 1 → AI routed, Level 2+ → blocked\n   - Destructive commands (delete, write, save, format, etc.): Level 1 → confirmation, Level 2+ → blocked\n   - System commands (reboot, shutdown, format, kill): Level 1+ → blocked\n   - Suspicious flags (--execute, --eval, --shell): Level 1+ → blocked\n\n4. **Safety checklist:**\n   - Check security: security shows your current level\n   - Before running risky commands: create a checkpoint first\n   - For temporary relax: security-level 0, then restore to 1\n   - For total lockdown before leaving: security-level 2\n\n5. **When to use:**\n   - User wants to lock down the terminal → security-level 2\n   - User wants to allow a blocked command → cmd-allow <cmd>\n   - Debugging strange behavior → verify security-level (user may have set it higher)"
}