25 lines
2.4 KiB
Markdown
25 lines
2.4 KiB
Markdown
# Security Invariants
|
|
|
|
These rules override every lower-level requirement.
|
|
|
|
1. **No arbitrary execution.** No generic shell, command, script, or interpreter tool may be exposed.
|
|
2. **No raw Docker capability.** The Docker socket is mounted only into the dedicated read broker. No raw Docker API proxy exists.
|
|
3. **No arbitrary file access.** Every readable path is registered, canonicalized, allowlisted, and mounted read-only.
|
|
4. **No unrestricted SQL.** v1 has no general database query tool. Future database access must use a dedicated least-privilege account and query guard.
|
|
5. **No secret retrieval.** Secrets can be consumed internally but never returned, indexed, audited verbatim, or shown in UI.
|
|
6. **Deny by default.** Absence of an explicit binding or allow decision means deny.
|
|
7. **Project and environment isolation.** Every invocation is checked against both dimensions; dev access never implies prod access.
|
|
8. **Connector revalidation.** Each connector validates caller context and target allowlists; gateway visibility is insufficient.
|
|
9. **Audience-bound tokens.** A token must be issued for the Hub resource and trusted issuer. Token forwarding to unrelated services is prohibited.
|
|
10. **Bounded input and output.** Requests, logs, repository files, search results, and lists have strict limits and pagination.
|
|
11. **Sanitized audit.** Audit records identify the action without storing access tokens, passwords, private keys, connection strings, or unlimited payloads.
|
|
12. **No destructive tools.** v1.0 target-system capabilities are read-only. Post-v1 bounded writes must remain reversible and may not expose merge, delete, force-push, default-branch mutation or repository administration.
|
|
13. **Reversible deployment.** Migrations and upgrades require backup, health verification, and a tested rollback or restore path.
|
|
14. **No implicit permission expansion.** Adding a connector or tool does not expose it to existing clients until explicit bindings are reconciled.
|
|
15. **Untrusted content remains data.** Repository files, docs, logs, and MCP results may contain prompt injection; they never modify policy or authorization.
|
|
|
|
|
|
## WP-160 additions
|
|
|
|
Connector and dataplane target URLs must use HTTPS and must not resolve from an unsafe IP literal or metadata/localhost hostname. The security scan is fail-closed for non-fixture secret patterns, raw Docker mounts, mutable third-party images, unsafe host/container settings, and unintended published ports.
|