---
name: security-and-safety
description: How to use WebX11 security levels, command blocking, and safety features
tags: [security, safety, blocking, permissions]
category: system
---
## Steps
1. **Security levels:**
   - security-level <0-3> — set security level:
     0 = Permissive (no blocks, no confirms — anything runs)
     1 = Standard (unknown cmds → AI route, destructive → confirm, system → block)
     2 = Paranoid (unknown cmds blocked entirely, destructive blocked)
     3 = Audit (everything allowed, everything logged)
   - Default: level 1
   - security — show current level, blocked count, and stats

2. **Command control:**
   - cmd-allow <cmd> — whitelist a command from security checks
   - cmd-deny <cmd> — blacklist/block a command entirely
   - whitelist built-in: help, clear, ls, cat, pwd, whoami, df, free, top, ps, echo, date, env, history

3. **What gets blocked at each level:**
   - Unknown commands: Level 1 → AI routed, Level 2+ → blocked
   - Destructive commands (delete, write, save, format, etc.): Level 1 → confirmation, Level 2+ → blocked
   - System commands (reboot, shutdown, format, kill): Level 1+ → blocked
   - Suspicious flags (--execute, --eval, --shell): Level 1+ → blocked

4. **Safety checklist:**
   - Check security: security shows your current level
   - Before running risky commands: create a checkpoint first
   - For temporary relax: security-level 0, then restore to 1
   - For total lockdown before leaving: security-level 2

5. **When to use:**
   - User wants to lock down the terminal → security-level 2
   - User wants to allow a blocked command → cmd-allow <cmd>