# The controller's own exposure (/docs/security/controller-exposure)



The web UI is the interactive path, so the controller holds more than a provisioning service would.

* **It can reach every workspace over SSH** with a key that is on the controller and nowhere else.
  Anyone who reaches the controller reaches every live workspace.
* **Auth is off unless `CONTROLLER_AUTH_SECRET` is set.** Without it there is no sign-in and no API
  key, and the only thing between the controller and a caller is the network it sits on.
* **The agent's screen is rendered as parsed spans, never as HTML.** An agent echoes file contents,
  diffs, and whatever a prompt told it to print. Handing that to an HTML converter would let any
  repository script the controller's own origin, where the operator's session cookie lives.
* **`ssh` does not preserve argument boundaries.** It joins the command and the remote shell splits
  it again, so every argument is quoted before it leaves. Without that, a repository name or an
  agent prompt carrying a semicolon is remote code execution under the controller's key.