Security Policy

Supported branch

Security fixes target the main branch.

Reporting a vulnerability

Use GitHub private vulnerability reporting for suspected security issues. Do not open a public issue containing exploit details, credentials, private repository data, or affected-user information.

Include the affected component, reproduction conditions, impact, and any safe supporting evidence. Maintainers will acknowledge and triage reports on a best-effort basis; response times are not guaranteed.

Security boundaries

RaphaelLoop coordinates host-provided Agents. It does not grant permissions, bypass sandboxing, approve destructive actions, or make production changes on a user's behalf. Credentials and active runtime state must remain outside this repository.

Install only from the expected repository or a reviewed local checkout. The Agent Skills CLI installs the Skill payload but does not execute its scripts. On first use, RaphaelLoop may register its bundled role definitions in the host Agent directory only after a target preview and explicit approval; conflicting files are backed up before replacement. CLI update and removal do not manage those host files. The initializer supports manifest-checked cleanup, performs no network fetch, and never downloads a separate Agent catalog.

The Python runtime kernel has no built-in network client and executes only verifier argument arrays from a validated contract with shell=False and finite timeouts. This is not a sandbox: verifier child processes inherit the host environment and operating-system authority and may read, write, or connect if their executable does so. Process-group termination is best effort; a command that deliberately creates a detached session may outlive the timeout. Use only reviewed project-local validation commands and retain the host sandbox and approval controls.

State changes use a filesystem lock and atomic replacement. Evidence logs are size-limited and hashed, but may still contain verifier output; contracts must not run commands that print credentials. Keep .raphael-loop/ out of version control unless its contents have been reviewed and intentionally sanitized.

Declaring a side effect does not authorize or execute it. Every side-effect declaration requires an existing approval gate and idempotency key; publishing, deletion, rollback, payment, production writes, credential use, and permission elevation remain under the host and user's explicit authority.