Security

Report a vulnerability

Use GitHub's private vulnerability reporting, not a public issue or an email. Only the maintainers can see the report. A failing request, a policy file or a short script helps more than a description.

SECURITY.md is the full process. If this page and that file ever disagree, the file is right.

In scope

The enforcement path, the policy engine, the audit chain and its verifier, the gateway and its authentication, tenant isolation, and the hosted playground. For example: getting an action through that your grants refuse, reading or changing another tenant's data, forging or breaking the audit chain without the verifier noticing, or making a control fail open without recording it.

Not a vulnerability

• A prompt injection a detector missed. Detection lowers the odds, it isn't a guarantee, and the miss rates are on the benchmark. Report it as a wrong verdict on support.
• An attack that works because a tool was declared with the wrong impact. Containment is only as good as the declarations.

What the code enforces

• Tenant isolation is attached to the database session, not to each query, so a new query can't forget it. tenancy.py
• The audit log is a hash chain with a standalone verifier that needs no database access and none of our code. chain.py
• Four controls can't be configured to fail open: tenant isolation, entitlements, data-access scope and the audit chain. availability.py

Audits

There has been no third-party audit, penetration test, SOC 2 or ISO 27001 certification, and there is no bug bounty. What exists is the source, the tests and a verifier you can run yourself.