Limits

What the security does not promise

• The encrypted directory protects as much as its password. Whoever has the password opens the volume and reads what it holds; a weak or reused password protects little.
• The safeguards are dated. The measures on this site belong to the version it describes. A model more recent than the ones tried can find a way around a safeguard that no trial has seen.

The same two statements stand in section 12 of the operator guide.

A client with a shell lifts the guard of the profile

The list of sites, the locked actions and the binding of credentials hold a model that has only the fourteen tools. A model to which the client also gives a shell under your account can edit profile.json, origin_policy included, start the server from a script of its own, and, while the encrypted directory is open, read the credential files. An origin added to allowed_origins that way is read by status at its next call.

The server does not stop it; the trace it leaves after a change of the lists of sites (The operator profile) can be erased by the same shell. What bounds such a model is the configuration of the client: give the tools to an agent whose shell asks you first (Connect an MCP client).

What the checks do not catch

• A page that moves at the last instant. A click checks its target again after the pointer moves, then asks the browser which element the press reached and releases the button away from the page if it is not the target. On a test page that swaps the button under the pointer every 2 ms, 300 clicks on Chrome 156: none reached the other button, where 29 had before the check. What is not caught: the handlers the page itself attached to the press run on whatever lay under the pointer, and the guard of a key or of a text is a script of the page, which a page that expects it goes round.
• What a person cannot read. Visibility is approximate: the server computes neither contrast nor overflow clipping, so text you cannot read can reach the model. A node with no box of its own is taken for hidden, with all it holds: on Chromium 141, a page whose body had no height gave no mark at all.
• A banner that covers nothing in view is not a layer, and can be cut like any element when the view holds more than the caps. A layer covers by its box, not by the pixels it paints, and at most 100 fixed or sticky nodes of a page are examined (When a page holds too much).
• A field it does not recognise as sensitive is shown, value included.
• A locked action worded otherwise. The lock reads words and card fields. On 100 common button labels it missed none and locked 2 that a careful reader would not (Effacer le formulaire, Supprimer le filtre); a label that says “pay” in other words is not locked.
• Downloads and dialogs constrain real tasks; they are on Use cases.

Not measured

• Chrome 154 with its profile kept inside an encrypted directory.
• Brave.
• A confirmation asked through a desktop MCP client (elicitation): tested with the client of the MCP SDK only.
• The zoom made by the Ctrl and + keys of a browser that is not headless, a screen whose scale really is 1.5, and a click on an element inside a frame of a scrolled page.
• The conversion of old credential files on a real gocryptfs volume.

The complete list, with each measure and the command that replays it, is in section 12 of the operator guide and in the README.