Security Policy

October 4, 2025 · View on GitHub

Privilege Scope

EquilateralAgents runs with the same privileges as your user account.

Agents have access to:

All files readable/writable by your user
Environment variables (including API keys)
Network access
Shell command execution
System resources (CPU, memory, disk)

Security Best Practices

API Key Management

# Use separate keys for development
OPENAI_API_KEY=sk-dev-...  # Development key
OPENAI_API_KEY=sk-prod-... # Production key (separate environment)

# Rotate keys regularly
# Set spending limits in provider dashboards
# Never commit .env files

Isolation Strategies

Docker (Recommended for untrusted workflows):

docker run -v $(pwd):/app -w /app node:18 npm start

Separate User Account:

# Create limited user for agent execution
sudo useradd -m -s /bin/bash agentuser
sudo su - agentuser

File Permissions:

# Restrict sensitive files
chmod 600 .env
chmod 700 .equilateral/

Monitor Agent Activity

Agent logs are stored in .equilateral/:

# Review workflow history
cat .equilateral/workflow-history.json

# Check database activity (if using SQLite)
sqlite3 .equilateral/orchestration.db "SELECT * FROM events ORDER BY created_at DESC LIMIT 10"

Review Agent Code

Before running new agents:

# Inspect agent implementation
cat agent-packs/security/SecurityScannerAgent.js

# Check for suspicious patterns
grep -r "exec\|eval\|child_process" agent-packs/