# Security Policy

## Trust model

Soluna orchestrates coding agents and repository verification commands. Use it only with repositories and task inputs you trust. Test/build scripts execute code from the target repository with the permissions of the MCP/CLI or DSH host process.

## Controls

- Child processes use argv arrays; model text is never interpolated into a shell command.
- Verification executables are allowlisted and cwd cannot leave the repository.
- Model outputs must pass local Zod schemas.
- Context paths cannot be absolute, traverse outward, or use symlinks; secret-like and binary paths are skipped.
- MCP stdout carries protocol data only. Diagnostics use stderr.
- State/config files are written with user-only modes where supported.
- Git content snapshots detect unreported workspace edits.
- Hooks are asynchronous telemetry only and always exit successfully.
- Installer backups and ownership snapshots protect existing Codex configuration.
- The DSH bundle only contributes tools and prompt guidance; it publishes no service and does not modify the DSH sandbox, approvals, shipped presets, or model credentials.

## Known boundary

An allowlisted command such as `npm test`, `cargo test`, or `make` may execute arbitrary code defined by a trusted repository. The allowlist prevents shell injection; it does not sandbox the repository's own build system. Codex workers still run under the configured Codex sandbox.

The native cooperative backend depends on the front Codex session honoring the returned dispatch. Correctness remains enforced by persisted verification/review gates, not hooks.

## Reporting

Do not open a public issue containing credentials, private source, or run artifacts. Use [GitHub private vulnerability reporting](https://github.com/Leopold-Fitz-AI/soluna-harness/security/advisories/new) with a minimal reproduction, impact, and affected version.

Supported security fixes currently target the latest `0.1.x` release. Maintainers will acknowledge a complete report as soon as practical and coordinate disclosure after a fix is available.