Security

Autonomy tiers, sandboxing, ingestion hardening

The full threat model and disclosure process are in SECURITY.md. This page is the operator's summary.

Autonomy modes

Set with ZECOR_MODE or the mode key in zecor.config.json. Default: hardened. zecor mode prints the active posture.

Mode	Use case	Writes	Auto-merge	Shell	External input
`greenfield`	New app, zero users, isolated workspace	files, branches, PRs	yes	unrestricted	trusted
`guarded`	Feature work on an existing repo	branch, author, test	only if every deterministic check passes clean	unrestricted	wrapped as untrusted
`hardened`	Production, public repos, untrusted input	branch, draft PR only	never — human review required	allow-listed	wrapped as untrusted

Sandboxing

Subprocess capping. Every external command runs in its own process group with a hard timeout and SIGKILL on overrun. The environment has ANTHROPIC_API_KEY / OPENAI_API_KEY removed.
Command allow-list (hardened). Any binary or leading argument not on an explicit whitelist is refused with exit 126 before it runs — git read/write subcommands, the deterministic gates, and the known tier appliers only.
MCP disabled. Model CLIs are invoked with an empty MCP config; tool definitions never enter a prompt.

Untrusted input

GitHub issues, PR comments, bug reports, and fetched web pages are wrapped in a nonce-delimited container with a standing instruction to treat everything inside as data, never as instructions. Fence-break attempts and role-boundary spoofs inside the payload are defanged. Wrapping is on in every mode except greenfield.

Secret-leak prevention

Before any draft PR is opened, the committed diff and the generated PR body are scanned for known credential shapes (AWS, GitHub, Slack, Google, OpenAI, Anthropic keys; private-key headers; secret = "…" assignments) and for high-entropy tokens. A hit flips the task to needs-human: the verified change stays on its branch, but no PR carries the leak. Run it by hand with zecor scan.

Reporting a vulnerability

Email security@zecor.dev. Do not open a public issue for an unpatched vulnerability. Acknowledgement within 72 hours; coordinated disclosure is the default.