Security
How an AI assistant's access to Ordessa is granted, limited and ended, and how to tell us about a vulnerability.
Connecting
- An assistant connects with OAuth 2.1 and PKCE. You sign in on an Ordessa page, never in the assistant.
- The page shows which application is asking — its own name and, beside it, the address it really comes from — and what it will be allowed to do.
- Ordessa accepts only applications from an explicit list of hosts, and only returns you to an address that application has published.
What a connection may do
- Two permissions: reading the catalogue, and changing it. A staff account is never given the second.
- A permission narrows what your account may do and never widens it. Every change is checked against your role and your company by the same code Ordessa Manager uses.
- No tool reaches outside your Ordessa catalogue: none sends messages, publishes elsewhere or browses the web.
- Tools that delete are marked as such, so the assistant asks for your confirmation. Many changes made together are applied all at once or not at all.
Tokens
- An assistant's token is issued for the Ordessa Manager connector only. The rest of Ordessa's API refuses it, and the connector refuses any other token.
- Access tokens last an hour. Refresh tokens change every time they are used, and one used twice ends the whole connection.
- Ordessa stores tokens only as one-way digests.
Ending a connection
Disconnect in Ordessa Manager, under AI assistants. Every request checks that its connection is still open, so it stops working at the next request, not when its token would have run out.
Reporting a vulnerability
Write to security@ordessa.org with what you found and how to reproduce it. We acknowledge every report and tell you what we did about it.
Please test only with an account of your own, never read or change another person's data, and give us a reasonable time to fix a problem before you disclose it.