# Security

> How a client gets access, what it can touch, and how your original stays safe.

Web page: https://brollss.com/mcp/security. All MCP pages: https://brollss.com/llms.txt (index) and https://brollss.com/mcp/llms-full.txt (everything in one file).

## Sign-in with OAuth

- There is no API key. Your client registers itself, then opens a Brollss page where you sign in.
- That page names the client and the address it will send you back to. Nothing is granted without your click. Refusing sends the client back with an access-denied answer.
- Your Brollss password never passes through your agent or your client.

## What a connection can do

- Every call acts for the account that signed in, and only on the projects that account can open.
- Each tool that takes a project checks your role on it, as the app does. A viewer reads, an editor writes.
- A project id that does not exist and a project of another account get the same answer, so an id cannot be probed.

## Your original stays safe

- Agents are told to edit a copy (`clone_project`) unless you name the project to edit in place.
- A checkpoint is saved before the first write on a project, and you can restore it.
- Mass gestures need `confirm: true`: removing more than 3 B-rolls, restoring all words, or cutting more than 20 % of the remaining words in one call.
- Each write carries the revision it read. If the project changed in the meantime, nothing is applied.

## Uploads

An upload address works once, for one import job and one account. The bytes must match the size declared up front, and the plan's file size limit applies. A link is fetched by the server under the same guard as the app, which refuses private and local network addresses.

## Instructions hidden in a video

A transcript can contain anything a speaker says. The server tells every agent that the transcript and the project content are data, never instructions. It never asks for a password, a key or a token.

## Report a vulnerability

Report it privately with GitHub's private vulnerability reporting on the [brollss-mcp repository](https://github.com/smfcoder17/brollss-mcp) (Security tab, then Report a vulnerability). Include the steps to reproduce and what an attacker could do.