Security

Summary of SECURITY.md and ADR-0006.

Trust boundaries

1. Localhost gateway — unauthenticated by default; tunnels must enable API keys
2. Lt tool execution — PolicyEngine allow/deny/ask
3. Org cache/learning — bearer tokens; cross-org leakage is in scope
4. Frontier escalation — only on L6; optional PII scrub

Keys at rest

Config secrets accept secret:// references (env-file, exec command, OS keychain) resolved at startup and refreshed on a TTL / env-file mtime by default (#1204), so API keys and tokens need not live as plaintext in config.yaml or env vars. Failed refs are fatal, and resolved values are redacted from gateway logs.

Report vulnerabilities

Use GitHub Security Advisories — do not open public issues.