# Security and privacy

## Public safe-core policy

The repository is intentionally safe to publish. Do not commit:

- access tokens, refresh tokens, cookies, API keys, credentials, or `.env`
  values;
- raw chat transcripts, real Session content, private knowledge, or internal
  business material;
- absolute machine paths, real `DSH_HOME` values, private ports, local logs,
  diagnostics, or screenshots containing sensitive information;
- private repository names, unredacted stack traces, or generated local state.

Use `agentworkos.local.toml` for machine-specific additions. It is ignored by
the repository and must not be packed into a release.

## Runtime safety

- The default posture is local-only and loopback-only where a listener is
  required.
- Runtime lifecycle actions use an allowlisted adapter.
- The UI cannot submit an arbitrary shell command.
- Remote control is not enabled by default.
- A failing optional integration must not prevent the DSH host from starting.
- The newest loader row must be independently disableable.

## Review gates

Before each public milestone:

1. Scan tracked files and Git history for secrets and private paths.
2. Check package file lists and release tarballs.
3. Run unit and contract tests for failure and cleanup paths.
4. Run an isolated DSH Profile cold-start check.
5. Prepare a sanitized Review Pack.
6. Ask the local DSH DeepSeek Pro profile to review architecture, DSH contract,
   privacy, tests, and public documentation claims.
7. Have a maintainer review the evidence before publishing.

The repeatable local commands are `npm run check:security` for the working tree
and Git history, plus `scripts/smoke-dsh-profile.mjs` for a read-only isolated
Profile composition check. The smoke command receives machine paths only from
the caller's ignored local environment and never writes them to the repository.

## Reporting a concern

Do not open a public issue with credentials, private logs, or raw diagnostics.
Describe the affected public file and a sanitized reproduction instead.