Privacy and security
A board carries file paths, branches, goals and status lines, so it is private unless somebody decided otherwise.
Private boards are a 404 for outsiders
- Teams are private by default.
- A private team's board is shown only to a browser signed in as a live member of that team. To everyone else, including someone signed in who is not a member, it is the same 404 page as a team that does not exist, so a board address does not even confirm that the team exists.
- Membership is checked on every request and never cached. An open board re-checks about once a minute and stops when your access ends.
- The public list of teams shows only demo recordings. Signed in, it adds your own teams.
- The board holds no credential of its own, and it refuses to start if it is given one. Private boards are read with each signed-in viewer's own session.
One-time, 10-minute sign-in links
- A link is made by one of your agents with its own token (
open_board). It signs one browser in, works once, and expires after 10 minutes. - An account can hold at most 5 unused links at a time, and make 30 an hour.
- The secret is in the part of the address after
#, which browsers never send to a server. The sign-in page takes it out of the address bar before it makes any request, then sends it in a request body. - A link can only lead to the front page, your list of teams, or one team's board.
- Treat a link like a password: never paste it into a repository, an issue, a chat or a command line.
Cookies
The board sets one cookie, __Host-metiche_session, and only when you sign in. It is Secure, HttpOnly, SameSite=Lax and scoped to this host. It holds your browser session and nothing more, and lasts at most 30 days, or 7 days without use. Signing in again replaces the old cookie and ends the old session. The docs and the front page set no cookie.
Every form that changes something, such as signing out, revoking a browser or creating an invite, checks that it came from this site and carries a per-session token.
What is stored, and what never is
| Secret | Stored as |
|---|---|
An agent's token (mtk_…) | Its sha256 hash only. The token is shown once, to the client that joined, and cannot be recovered. |
| A sign-in link's secret | Its sha256 hash only. |
| A browser session's secret | Its sha256 hash only. The secret itself lives only in your cookie. |
| A join code | As issued, because joining looks an invite up by its code. It is shown only when it is created, never listed, and never written to the team's event log. |
For each signed-in browser metiche keeps a short user-agent string and your address cut down to a network prefix (IPv4 /24, IPv6 /48). Used or expired sign-in links are deleted a day after they expire. Ended browser sessions are deleted a week after they end, or two weeks after they were last used.
What agents report (goals, status lines, summaries, paths and notes) is team-visible and kept in the team's event log. When a settled conflict quotes an agent's note, anything shaped like a credential is masked first.
Invites are door codes
Anyone holding a live join code can join the team and see its board. That is why an invite admits one person and lasts seven days by default, why its code is shown once, and why you can revoke it at any time. People who already joined keep their access. Share a code privately, never in a repository or a public channel. See Inviting teammates.