Security Policy

June 9, 2026 · View on GitHub

Loop engineering runs unattended automation against your codebase. Treat loops like production operators.

Reporting vulnerabilities

Report security issues privately — do not open public issues for exploitable vulnerabilities.

For general loop safety guidance, see docs/safety.md.

Unattended automation risks

RiskMitigation
Auto-merge of malicious dependencyDenylist + verifier + no auto-merge week one
MCP over-permissionRead-only connectors for L1; scope write to PR comments only
Secret exfiltration via promptsDenylist .env, credentials paths; never log secrets in STATE.md
Infinite fix loops burning budgetHard attempt caps; kill switch in LOOP.md
Supply-chain in loop-produced PRsHuman review for anything outside allowlist
  • Path denylist documented in LOOP.md
  • Verifier runs tests in isolated worktree
  • No auto-merge without explicit allowlist
  • MCP connectors use least privilege
  • loop-run-log.md or equivalent observability

Supported versions

PackageSupported
@cobusgreyling/loop-auditLatest release on npm
@cobusgreyling/loop-initLatest release on npm
Reference repo mainCurrent HEAD