What Dinoer does not do behind your back

You are about to give a research pipeline access to your credentials and to your machine’s outbound traffic. Here is what that rests on, with the file that enforces each point.

Dinoer never puts your credentials in a terminal

They never pass through your shell, your command history or Dinoer’s logs: the value is read from the encrypted directory inside the process that drives the browser, at the moment a field is filled.

→ lib/repertoire_chiffre.py. How a credential reaches a form →

A scenario that writes a secret in clear is refused before the browser starts: a remplir on a field whose selector looks sensitive (password, token, otp, cvv and others) with a value other than depuis_secrets, or an evaluer script that contains a token or a high-entropy key.

What Dinoer writes is filtered by default: values returned by evaluer, URLs and error messages sent to the output or to the operations journal are neutralised. --no-filtre-evaluer turns this off, and the output then says so (boussole.filtre_evaluer_actif: false).

→ lib/sanitisation.py

What this does not cover: the agent driving Dinoer has its own access to your machine. With a terminal, it can read your mounted directory like any other file. Dinoer protects the path it controls, not one you open next to it.

The model that writes the report stays off the web

On every call to OpenCode, invoquer_opencode() sets websearch and webfetch to deny in OPENCODE_CONFIG_CONTENT, merged with any value you had already set. The denial therefore holds whatever directory Dinoer is launched from; the opencode.jsonc at the root of the repository says the same for a launch from there. Measured on 25 September 2026 with opencode debug config (OpenCode 1.18.32), launched from /tmp: with this value, websearch and webfetch are deny; without it, allow.

→ lib/modeles.py::invoquer_opencode()

The denial exists because on 14 August 2026 a campaign caught the model making twelve web searches while it wrote the report. They showed only in a record of the model’s full stream of events, not in the text it returned.

What this does not cover: bash stays allowed, because some scenarios ask the model to send a notification with curl. A model denied websearch reached the web with bash curl during a test run. Of the guarantees on this page, this is the only incomplete one.

Dinoer reports; it does not decide

pret_a_agir: false means that something was noticed: a WAF signature, a session drift, a navigation cap reached, JavaScript errors. It does not stop the run: Dinoer reports, and you decide.

WAF detection works by keywords and can be wrong. It is reported as a count, never raised as an error that halts execution, and --ignorer-waf exists for when you have checked.

The browser core does only what the scenario lists, with one exception

Every click, keystroke and navigation of the browser core is a line of a scenario file, checked against a schema before the browser starts.

→ scenarios/schema.json

The research pipeline is different: campagne.py asks a model to judge whether a page answers an open question, or whether two pages describe the same event. This guarantee covers the browser core, not that judgment.

You can review everything afterwards

Every run is recorded in an append-only operations journal: what was attempted, where, with what result, and the intention given for it. journal.py reads it.

→ journal.py, /var/log/dinoer/operations.jsonl

What leaves your machine

Besides the requests to the pages themselves, three things can, each by your choice: the queries sent to your SearXNG instance, the collected text sent to the OpenCode model, and a notification to a ntfy server (ntfy.sh unless you set another). Your credentials do not. The full table, with the file behind each line, is on the architecture page.

What Dinoer does not claim

It is no more careful than the scenario or the manifest you give it. A wrong one does real damage, at machine speed. And the guarantee on the corpus covers where an answer came from, not whether the question was the right one.