⚠️ Do NOT file a public GitHub issue for security vulnerabilities.

1. Email: Send details to the maintainers via GitHub's private vulnerability reporting:

   • Go to Security tab
   • Click "Report a vulnerability"

2. Include:

   • Description of the vulnerability
   • Steps to reproduce
   • Affected versions
   • Potential impact
   • Suggested fix (if any)

Given this project involves AI agent execution with shell access, we take these especially seriously:

• Command injection in shell.exec or any tool handler
• Path traversal bypass in guardrails.pathTraversal
• Arbitrary file read/write via tool arguments
• Rate limit bypass enabling DoS
• Permission escalation in plugin system
• Supply chain risks in dependencies

• LLM prompt injection (inherent to AI systems, not a code vulnerability)
• Missing features (e.g., "should add sandboxing for X")
• Configuration errors by the user

This project implements defense-in-depth for shell execution:

1. Whitelist-only — Only approved commands can run (ALLOWED_COMMANDS)
2. No shell — execFileSync with parsed args (no shell: true)
3. Arg parsing — parseCommandArgs with escape sequence support
4. Pattern detection — Blocks command substitution ($(), `) and destructive commands
5. Path validation — pathTraversal() with path.normalize(), explicit projectRoot, and fs.realpathSync() for symlink resolution
6. File limits — maxFileSize, maxFiles, maxDepth prevent OOM
7. Rate limiting — Prevents abuse of tool calls
8. Result truncation — 100KB limit prevents memory exhaustion

For the full security fix history, see CHANGELOG.md.

Key security fixes by version: