Security & Permissions

Data Security and Keys

Model storage, encryption behavior, and key management guidance

Data Security and Keys

Local CLI state uses encrypted SQLite stores:

  1. City-local state and credentials: ~/.downcity/downcity.db
  2. Federation admin profiles and session metadata: ~/.downcity/federation.db
  3. Agent binding is stored in the CLI global DB as execution.modelId

How secrets are protected

Provider apiKey, channel credentials, user sessions, and Federation administrator metadata are not stored in plaintext. Passwords are stored as PBKDF2 digests; session tokens are stored hashed or encrypted before being written to local SQLite stores.

city env is an explicit file-based configuration feature. Global Env is stored in plaintext at ~/.downcity/.env, and Workspace Env is stored in plaintext in the project .env. The Global file is restricted to the current user, and project .env is added to .gitignore by default. Use the launch environment or a secret manager when stronger secret protection is required.

Key source priority:

  1. DC_MODEL_DB_KEY
  2. ~/.downcity/main/model-db.key

Best practices

  1. Never commit ~/.downcity or any key material.
  2. Use a secret manager to inject DC_MODEL_DB_KEY in team/production environments.
  3. After key rotation, validate model connectivity through CLI and one real invocation.
  4. Never commit Workspace .env, and keep ~/.downcity/.env accessible only to your user account.

Chat Access

Understand the admission model for Chat users entering an Agent

CLI

City manages local Agents; Fed manages Federation Servers

Table of Contents

Data Security and KeysHow secrets are protectedBest practicesRelated docs