Skip to content

SECURITY.md

Latest commit

 

History

History
59 lines (41 loc) · 3.51 KB

SECURITY.md

File metadata and controls

59 lines (41 loc) · 3.51 KB
Raw

Security Policy

ForgeWorks orchestrates LLM-driven agents that can read code, run shell commands, and write files. Treat it with the same caution as any code-execution automation. This policy explains the security model, supported versions, and how to report vulnerabilities.

Supported versions

Version Supported
0.1.x ✅ security fixes

We are pre-1.0; breaking changes are possible. Pin a version in production.

Threat model & built-in defenses

ForgeWorks is built default-deny, explicit-allow. The layers below are in skillforge/src/core/permission.py (full 6-layer model) and in loop-engine's read-only-by-default agents.

Layer What it does
Permission Modes default (ASK) / acceptEdits / plan / bypass. bypass can be disabled by enterprise policy.
Permission Rules Tool-level + parameter-level Tool(param:value) matching. Precise deny/allow wins.
Enterprise Managed Un-overridable by lower layers; blocks dangerous commands (rm -rf /, fork bombs, mkfs, dd of=/dev/hd*).
Sandbox Bash isolation + network domain allow/deny lists; autoAllowBashIfSandboxed defaults to false.
Hook Gates Programmable deny at PreToolUse / Stop.
Settings Hierarchy Enterprise > User > Project > Local.

loop-engine agent tool surfaces

Each agent's .md declares its allowed tools. Reviewers (scope-analyzer, code-reviewer, confidence-evaluator) are read-only (git diff/log, Read, Grep, Glob). Writers (bug-fixer, test-data-preparer) get Write/Edit/scoped Bash. test-runner is scoped to test commands only (pytest/jest/go test/cargo test/coverage).

Hardening recommendations for production

  1. Never run on the production critical path unattended. Start with PR self-review (read-only) before any auto-fix loop in CI.
  2. Use a relay/gateway (base_url in agent_models) so all LLM calls are auditable and revocable centrally. Do not let agents call model providers directly.
  3. Pin disableBypassPermissionsMode: "disable" in managed settings for CI.
  4. Sandbox on. sandbox.enabled: true, explicit allowedDomains, allowUnsandboxedCommands: false.
  5. API keys via env vars only (${RELAY_API_KEY}), never committed. .gitignore already excludes .env.
  6. Review .qa-memory.json / checkpoints if running across untrusted branches — they persist finding signatures.
  7. MQ tests with strategy: real spin up testcontainers brokers; ensure your CI environment permits that.

Reporting a vulnerability

Please do not open a public GitHub issue for security vulnerabilities.

  • Email the maintainers (add a security contact address here before going public — e.g. security@<your-domain>), or
  • Use GitHub's Report a vulnerability flow (Security tab → "Report a vulnerability").

Include:

  • Affected component (loop-engine / skillforge / specific engine file)
  • A minimal reproduction (config + command)
  • Impact and any escape from the documented permission/sandbox model
  • Suggested fix if you have one

We will acknowledge within 72 hours and aim for a fix or mitigation within 30 days for high-severity issues. Coordinated disclosure is appreciated.

What is NOT in scope for a security report

  • LLM hallucinations or wrong code suggestions (ForgeWorks is assist, not replace; a human always merges)
  • Findings the model missed (use a regular issue / discussion)
  • Self-inflicted damage from running with bypass mode disabled-safety on untrusted code