diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1013d0ac..42d948a2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+- **Security:** Host Console and container exec WebSocket endpoints now reject `node_proxy` scoped JWT tokens with HTTP 403 — machine-to-machine proxy credentials can no longer be used to open interactive terminals.
+- **Security:** `stackParam` query parameter on `/api/system/host-console` is now validated against `path.resolve` + `startsWith(baseDir)` to prevent directory traversal when setting the PTY working directory.
+- **Security:** `HostTerminalService` no longer forwards the full `process.env` to spawned PTY shells; `JWT_SECRET`, `AUTH_PASSWORD`, `AUTH_PASSWORD_HASH`, and `DATABASE_URL` are stripped before the shell is spawned.
 - **Fixed:** Animated design system overhaul — 9 UI bugs resolved: (1) compose.yaml ↔ .env tab switching no longer accumulates height (Monaco's internal `position:static` child created a circular CSS dependency with the grid; fixed by resetting Monaco to 0×0 then forcing a synchronous reflow before re-measuring); (2) sliding tab indicator on compose/env tabs; (3) sliding tab indicator on Notification tabs (Discord/Slack/Webhook); (4) switch thumb now animates position (added Radix data-attribute CSS translation); (5) "Always Local" badge tooltip no longer crashes the page (replaced animate-ui tooltip that called `getStrictContext` with pure Radix primitives); (6) Auto theme option added to Appearance settings (light/dark/auto with `window.matchMedia` listener); (7) Cancel/Add Node buttons in NodeManager dialogs no longer stuck together (added custom `DialogFooter` with proper gap classes); (8) AlertDialog now uses spring animation (`stiffness: 380, damping: 32`) and Quick Clean button text wraps correctly; (9) Resources/App Store/Logs menu buttons now toggle off on second click. Monaco container received `overflow-hidden` to prevent height escape.
 - **Added:** `motion` package and `animate-ui` animated component library as the animation foundation for the design system.
 - **Changed:** Design system overhauled — new brand cyan token (`--brand`, `oklch(0.72 0.14 200)` dark / `oklch(0.50 0.14 200)` light) applied to focus rings across both themes. CSS custom properties added for motion easing curves (`--ease-spring`, `--ease-out-expo`), animation durations, and stagger delay utilities. `prefers-reduced-motion` respected globally.
diff --git a/backend/src/index.ts b/backend/src/index.ts
index 5c8202d0..d381b8a1 100644
--- a/backend/src/index.ts
+++ b/backend/src/index.ts
@@ -456,7 +456,11 @@ server.on('upgrade', async (req, socket, head) => {
     const settings = DatabaseService.getInstance().getGlobalSettings();
     const jwtSecret = settings.auth_jwt_secret;
     if (!jwtSecret) throw new Error('No JWT secret');
-    jwt.verify(token, jwtSecret);
+    const decoded = jwt.verify(token, jwtSecret) as { username?: string; scope?: string };
+
+    // Node proxy tokens are machine-to-machine credentials and must never be granted
+    // interactive terminal access (host console or container exec).
+    const isProxyToken = decoded.scope === 'node_proxy';
 
     const url = req.url || '';
     const parsedUrl = new URL(url, `http://${req.headers.host || 'localhost'}`);
@@ -520,15 +524,29 @@ server.on('upgrade', async (req, socket, head) => {
         }
       });
     } else if (hostConsoleMatch) {
+      // Node proxy tokens must not access interactive host terminals
+      if (isProxyToken) {
+        socket.write('HTTP/1.1 403 Forbidden\r\n\r\n');
+        socket.destroy();
+        return;
+      }
       const hostConsoleWss = new WebSocket.Server({ noServer: true });
       hostConsoleWss.handleUpgrade(req, socket, head, (ws) => {
         hostConsoleWss.close();
         let targetDirectory = '';
         try {
-          targetDirectory = FileSystemService.getInstance(nodeId).getBaseDir();
+          const baseDir = FileSystemService.getInstance(nodeId).getBaseDir();
           const stackParam = parsedUrl.searchParams.get('stack');
           if (stackParam) {
-            targetDirectory = path.join(targetDirectory, stackParam);
+            const resolved = path.resolve(baseDir, stackParam);
+            if (!resolved.startsWith(path.resolve(baseDir))) {
+              ws.send('Error: Invalid stack path\r\n');
+              ws.close();
+              return;
+            }
+            targetDirectory = resolved;
+          } else {
+            targetDirectory = baseDir;
           }
         } catch (e) {
           targetDirectory = FileSystemService.getInstance(NodeRegistry.getInstance().getDefaultNodeId()).getBaseDir();
@@ -544,7 +562,13 @@ server.on('upgrade', async (req, socket, head) => {
         }
       });
     } else {
-      // Generic terminal WebSocket
+      // Generic terminal WebSocket (container exec)
+      // Node proxy tokens must not access interactive container terminals
+      if (isProxyToken) {
+        socket.write('HTTP/1.1 403 Forbidden\r\n\r\n');
+        socket.destroy();
+        return;
+      }
       wss.handleUpgrade(req, socket, head, (ws) => {
         wss.emit('connection', ws, req);
       });
diff --git a/backend/src/services/HostTerminalService.ts b/backend/src/services/HostTerminalService.ts
index ce38cbfe..98436682 100644
--- a/backend/src/services/HostTerminalService.ts
+++ b/backend/src/services/HostTerminalService.ts
@@ -16,12 +16,19 @@ export class HostTerminalService {
     static spawnTerminal(ws: WebSocket, targetDirectory: string) {
         const shell = os.platform() === 'win32' ? 'powershell.exe' : getUnixShell();
 
+        // Strip sensitive backend secrets from the PTY environment so they are not
+        // visible to the console user via `env` / `printenv`.
+        const SENSITIVE_KEYS = ['JWT_SECRET', 'AUTH_PASSWORD', 'AUTH_PASSWORD_HASH', 'DATABASE_URL'];
+        const safeEnv = Object.fromEntries(
+            Object.entries(process.env as Record<string, string>).filter(([k]) => !SENSITIVE_KEYS.includes(k))
+        );
+
         const ptyProcess = pty.spawn(shell, [], {
             name: 'xterm-color',
             cols: 80,
             rows: 30,
             cwd: targetDirectory,
-            env: process.env as Record<string, string>,
+            env: safeEnv,
         });
 
         ptyProcess.onData((data) => {