Security Policy (SECURITY.md)
Supported versions, vulnerability disclosure, and the 7 non-negotiable security invariants enforced by LOKI.
Supported Versions & Reporting
Security updates are provided for the latest release line (1.9.x / 1.10.x). If you discover a security vulnerability (such as a bypass of the target authorization gate, a leak of sensitive credentials in scrubbed HARs or recorded journeys, a path traversal or command injection vector, or an escape from local-only infrastructure chaos), do not open a public GitHub issue. Report it privately via [GitHub Private Vulnerability Reporting](https://github.com/MatiSca99/LOKI/security/advisories/new) (48h acknowledgment, 7d triage & remediation plan).
Core Security Guardrails & Invariants
| Flag | Type | Default | Description |
|---|---|---|---|
| A. Target Authorization Gate | safety.py | Always enforced | ensure_target_authorized() allows localhost (127.0.0.1, ::1, 0.0.0.0) without friction and blocks any remote host until confirmed interactively (typing the exact hostname) or via --authorized. Stored in .loki/authorized_targets.json (gitignored). |
| B. Network HAR Scrubbing | scrubber.py | Fail-closed | NetworkScrubber.scrub_har_file() redacts auth headers, cookies, JWTs, API keys (sk-, ghp_, AIza), PEM keys, and sensitive query/body params before writing network.har. If scrubbing fails, the HAR is deleted. |
| C. Journey Credential Masking | recorder.py | ******* | loki record masks input[type='password'] and fields matching password, passwd, pwd, secret, token, api_key, apikey, cvv, cvc, credit_card, card_number, or ssn as "*******" before saving .loki/journeys/<name>.json. |
| D. Ephemeral Browser Sandbox | sandbox.py | Isolated | Every chaos run launches a fresh Playwright BrowserContext with zero shared cookies, localStorage, or profile state from the host user's personal browser. |
| E. Local-Only Infra Chaos | infra_chaos.py | Localhost only | loki infra (kill, pause, cpu-stress, memory-stress) acts strictly on local OS processes and local Docker containers, never remote hosts or cloud APIs. |
| F. Safe CodeHealer Patching | healer.py | .loki.bak + verify | CodeHealer confines file resolution inside the repository root (relative_to), creates <file>.loki.bak before patching, verifies via repro_test.py, and rolls back automatically if the crash persists. |
| G. AI Provider & Key Hygiene | config.py | Env vars | API keys are read from environment variables (GEMINI_API_KEY or api_key_env), never hardcoded in source or committed to .loki/ artifacts. |