# Security Policy

## Security boundary

The plugin transforms only the record returned by the official `session-telemetry/record` waterfall. It does not read or write files, open network connections, register model-facing capabilities, change backend sharing policy, or mutate the canonical session log.

Here, “fail-closed” has one narrow meaning: when mounted through the official `SessionTelemetryCoordinator`, a thrown rule is contained and that single export copy is not handed to that coordinator's backend. It does not mean the whole process, every backend call, or every possible listener ordering is unbypassable. Loading this listener into a third-party dispatcher that ignores the official containment contract is outside the supported boundary.

The listener registers with Cordis `prepend`, so it wraps normally registered rules and redacts their final return value. A later plugin can deliberately register another prepended outer listener and transform the already-redacted record afterward; deployment owners must review waterfall listeners and keep any such outer rule from adding sensitive data.

The fixed rules deliberately trade fidelity for non-disclosure. A sensitive key replaces its complete value, and recognized string credentials are replaced rather than partially masked. Credential-bearing key names are rewritten; a collision created by that rewrite rejects the record. The configurable replacement is public output text; supported credential patterns are rejected at load, but the plugin cannot prove arbitrary user-selected text is non-secret.

## Residual risk

Pattern redaction cannot guarantee detection of every opaque or novel credential. Deployments should also minimize telemetry collection, use the official default-disabled sharing policy until explicitly authorized, restrict collector access and retention, and treat exported records as sensitive even after redaction.

Provider and exporter configuration is outside the record waterfall. In particular, LLM `apiKey`/`apiKeyEnv`, provider request `headers`, OTel exporter `headers`, and collector endpoint credentials are never input to this plugin unless some other component explicitly copies them into a session event. Direct calls to a backend's `emit()`, and a later prepended outer listener that adds data after this plugin returns, bypass this rule. See [SECRET-MATRIX.md](SECRET-MATRIX.md).

## Reporting a vulnerability

This local repository has no public security contact or release channel. Do not publish a live credential or raw session log in a report. Preserve a minimal synthetic reproducer, the plugin commit SHA, DSH version/commit, Node version, and whether the record reached a backend. Share that evidence only with the repository owner through a private channel before any public disclosure.