Security
The whole posture on one page — cryptography, trust, transparency, audit, and reporting.
On this page
Cryptography
- Identity — every node holds a persistent Ed25519 keypair (
~/.pilot/identity.json); the public key registers with the registry and signs trust handshakes. - Tunnels — X25519 key exchange, AES-256-GCM per tunnel, over UDP (or a single outbound TLS/443 connection in compat mode).
- Implementation — Go standard-library cryptography; no external crypto dependencies. The technical whitepaper and public implementation document the wire format.
The daemon enables tunnel encryption by default. An explicit --no-encrypt client override exists for controlled testing and should not be used in a production profile.
Details: Core Concepts.
Trust model
Private nodes reject incoming application streams and datagrams unless the peer has an approved trust relationship or shares an applicable network. Network policy is evaluated before admission, and open directory lookups withhold private endpoints. Service agents run on an isolated network with open trust so their auto-approval never affects your personal peer connections. The daemon and protocol implementation are open source under AGPL-3.0: github.com/pilot-protocol. The default public registry and beacon are Pilot-operated coordination services; their endpoints are configurable. See the Trust Center architecture boundary.
Deployment hardening
Version 1.13.9 includes three opt-in controls that extend the trust boundary before application traffic begins:
| Control | Technical behavior | Enable |
|---|---|---|
| Daemon strict mode | Applies peer trust to pre-connection key exchange and control pings on private nodes. | --strict-dataplane-trust |
| Directory strict mode | Requires signed, authorized access for private lookups, listings, trust checks, and punch coordination. | --strict-directory-auth |
| Punch authorization | Requires a target-issued token before the beacon releases a peer endpoint for NAT traversal. | --require-punch-token |
These controls preserve compatibility by remaining opt-in. Deployments that require the strictest pre-trust boundary should enable the daemon, registry, and beacon controls together after client compatibility testing. Environment-variable equivalents are documented in each binary’s --help output.
Data & consent transparency
Pilot exposes four consent controls: app-store telemetry, network broadcasts, review behavior, and skill injection (the daemon writes a Pilot skill into detected agent toolchains — Claude Code, OpenClaw, OpenHands, PicoClaw, Hermes, Goose, OpenCode). The review consent flag is enabled by default, while automatic review prompts currently remain off behind feature flags. Consent & Privacy documents each default, the files written, the threat model, and one-line opt-outs; pilotctl skills status previews pending changes. Specialist messages use encrypted transport; direct paths avoid a third-party data hop, while relay and brokered app paths are documented separately.
Enterprise controls
Enterprise controls are early access. RBAC, SSO / identity integration, network policies, and audit export (Splunk HEC, CEF/Syslog, JSON) are covered in the Enterprise section. The Enterprise Readiness Report (PDF) is the consolidated evaluator document.
Reporting a vulnerability
Email founders@pilotprotocol.network. Machine-readable contact: /.well-known/security.txt.