Skip to content

Security: kanwa2006/RECEIPTS

Security

SECURITY.md

Security — scoped to a judged public demo

  • Secrets: .env only, never committed; .env.example documents shape. Uploaded transcripts pass a regex redaction sweep client-side and are re-scanned server-side.
  • Sandbox: --network none, non-root, image pinned by digest, CPU/mem/120s limits, repo mounted read-only + tmpfs workdir, output size caps.
  • Prompt injection: transcripts are untrusted; see ENGINEERING.md Prompt Policy. Instructions found inside a transcript are cataloged, never obeyed.
  • Command injection: verifiers execute only allowlisted command templates with validated parameters; no raw model-generated strings reach a shell.
  • Input validation: JSONL schema-checked at ingest; oversized events rejected.
  • Rate limiting: simple per-IP limit on the upload endpoint.
  • Auth: none by design — public demo instance, disposable data, retention stated on the intake page. (Out of scope for v1; noted for production.)
  • Audit trail: the spend ledger + verdict ledger are the audit log.
  • Headers: basic security headers middleware (one function; no CSP theater).

There aren't any published security advisories