Part of Plan: a very secure browser in Seed (0.1). The daemon's localhost API must authenticate the desktop app and refuse requests that come from web pages, in any browser. Listen on loopback by default with a flag for servers; a per-launch secret the desktop sends on every private read or write; a credential required when a request carries browser fetch metadata or a foreign Origin; a cross-origin allowlist instead of the open policy; public IPFS reads stay public. Verified by a Go test and an Electron end-to-end test that loads a page from a public-marked address and proves it is refused. Backend review: Julio and Burdiyan.