Security Policy
Supported versions, vulnerability reporting, and Trajectory IR threat areas.
Trajectory IR sits on the critical path of agent tool execution. A compromise here can mean unauthorized tools, seal tampering, or leakage of sensitive data.
This page summarizes the engine SECURITY.md. OpenSSF Best Practices: project 14075.
1. Supported versions
Trajectory IR ships 0.2.x (Phase 1C harden and adopt; Go primary, Python reference). Older 0.1.x tags remain available but are not the active development line.
| Version | Supported | Notes |
|---|---|---|
| v0.2.x | :white_check_mark: | Current (Go primary, Python reference) |
| v0.1.x | :warning: | Security fixes only if maintainers agree; prefer upgrading |
| < v0.1 | :x: | Historical (CAMI/CLOOP prototypes) |
2. Reporting a vulnerability
Please do not report security vulnerabilities through public GitHub issues.
To adhere to cloud-native security standards (CNCF TAG Security best practices), we enforce coordinated vulnerability disclosure:
- Primary: GitHub Private Vulnerability Reporting on Coder-s-OG-s/Trajectory-IR → Security → Advisories → Report a vulnerability.
- Backup: contact the lead maintainers at
siddharthagithub0007@gmail.comorayushpatel2731@gmail.comif Private Advisories are unavailable.
We aim to acknowledge reports within 48 hours. Follow the Code of Conduct.
3. Scope highlights
Execution & tool safety
- Safety-boundary bypasses (misclassifying dangerous tools as
PURE/READ_ONLY); sandbox also rejectsAGENT_SPAWNandSENSITIVE, not justNON_IDEMPOTENT_WRITE - Block-and-gate evasion on interrupted
NON_IDEMPOTENT_WRITE - Issues in durable backend adapters (
drivers/durable_backend/on Python; Go Temporal adapters) - Claiming a
TOOL_CALLslot must be atomic so concurrent workers cannot double-run aNON_IDEMPOTENT_WRITEtool (R02) - Path confinement races: the Go MCP server resolves and validates workspace paths atomically (CWE-367)
State & durability
- Seal tampering that mutates payloads without breaking content-hash identity
- CAS / cache poisoning that bypasses hash verification
.tir packages
- Sensitive leakage on redacted export
- Zip bombs / oversized members must be rejected (
TirLimitError) import_tiralways verifies; unverified load paths (load_tir_unverified/LoadUnverified, gated byTRAJIR_ALLOW_UNVERIFIED=1) must never write to a durable NodeLog- Optional package signatures (
trajir-pkg-sig-v1, Ed25519) prove publisher authenticity when aSIGNATUREmember is present; unsigned packages remain valid by default verify_packagerejects an empty or misconfigured trust store instead of silently skipping the check
Implemented vs planned
We would rather be honest about what's actually built than let this page read as a roadmap.
| Control | Status |
|---|---|
| Fail-closed MCP effect mapping | Implemented |
Atomic TOOL_CALL claim (gate) | Implemented |
.tir size / path safety limits | Implemented |
| Redacted export (secret-like keys/values + thoughts) | Implemented (basic heuristic — still review before external sharing), including Go .tir export |
Package digital signatures (trajir-pkg-sig-v1) | Implemented (optional; verify on load when present); Sigstore remains future |
| Full multi-tenant SaaS isolation | Not a product surface yet; tenant_id filter on list/export exists |
| Fluid / k8s cache poisoning controls | Design only (future profile) |
Continuous dependency scanning
- Go:
govulncheck ./...runs in CI - Python:
pip-auditruns in the Security (pip-audit) CI job
4. Contributor accountability
If you use AI coding assistants to draft PRs, you remain accountable for security flaws. Changes to effect classification or resume / block-and-gate logic need careful human review.
Thank you for helping keep Trajectory IR safe and verifiable.