ForgeWorks orchestrates LLM-driven agents that can read code, run shell commands, and write files. Treat it with the same caution as any code-execution automation. This policy explains the security model, supported versions, and how to report vulnerabilities.
| Version | Supported |
|---|---|
| 0.1.x | ✅ security fixes |
We are pre-1.0; breaking changes are possible. Pin a version in production.
ForgeWorks is built default-deny, explicit-allow. The layers below are in skillforge/src/core/permission.py (full 6-layer model) and in loop-engine's read-only-by-default agents.
| Layer | What it does |
|---|---|
| Permission Modes | default (ASK) / acceptEdits / plan / bypass. bypass can be disabled by enterprise policy. |
| Permission Rules | Tool-level + parameter-level Tool(param:value) matching. Precise deny/allow wins. |
| Enterprise Managed | Un-overridable by lower layers; blocks dangerous commands (rm -rf /, fork bombs, mkfs, dd of=/dev/hd*). |
| Sandbox | Bash isolation + network domain allow/deny lists; autoAllowBashIfSandboxed defaults to false. |
| Hook Gates | Programmable deny at PreToolUse / Stop. |
| Settings Hierarchy | Enterprise > User > Project > Local. |
Each agent's .md declares its allowed tools. Reviewers (scope-analyzer, code-reviewer, confidence-evaluator) are read-only (git diff/log, Read, Grep, Glob). Writers (bug-fixer, test-data-preparer) get Write/Edit/scoped Bash. test-runner is scoped to test commands only (pytest/jest/go test/cargo test/coverage).
- Never run on the production critical path unattended. Start with PR self-review (read-only) before any auto-fix loop in CI.
- Use a relay/gateway (
base_urlinagent_models) so all LLM calls are auditable and revocable centrally. Do not let agents call model providers directly. - Pin
disableBypassPermissionsMode: "disable"in managed settings for CI. - Sandbox on.
sandbox.enabled: true, explicitallowedDomains,allowUnsandboxedCommands: false. - API keys via env vars only (
${RELAY_API_KEY}), never committed..gitignorealready excludes.env. - Review
.qa-memory.json/ checkpoints if running across untrusted branches — they persist finding signatures. - MQ tests with
strategy: realspin up testcontainers brokers; ensure your CI environment permits that.
Please do not open a public GitHub issue for security vulnerabilities.
- Email the maintainers (add a security contact address here before going public — e.g.
security@<your-domain>), or - Use GitHub's Report a vulnerability flow (Security tab → "Report a vulnerability").
Include:
- Affected component (
loop-engine/skillforge/ specific engine file) - A minimal reproduction (config + command)
- Impact and any escape from the documented permission/sandbox model
- Suggested fix if you have one
We will acknowledge within 72 hours and aim for a fix or mitigation within 30 days for high-severity issues. Coordinated disclosure is appreciated.
- LLM hallucinations or wrong code suggestions (ForgeWorks is assist, not replace; a human always merges)
- Findings the model missed (use a regular issue / discussion)
- Self-inflicted damage from running with
bypassmode disabled-safety on untrusted code