Trajectory IR acts as the durable semantic and execution layer for autonomous AI agents. A compromise in this layer could lead to unauthorized tool execution, state manipulation, or the leakage of sensitive data (like PII or secrets).

This policy is tightly integrated with our Infrastructure Design, Contributing Guidelines, AI Usage Policy, and Code of Conduct.

Machine-readable OpenSSF Security Insights for this repository live in SECURITY_INSIGHTS.yml (contacts, vulnerability reporting acceptance, license, and CI security tooling). Keep that file in sync when this policy changes.

Trajectory IR ships 0.2.x (Phase 1B Go primary + Phase 1C harden). Older 0.1.x tags remain available but are not the active development line.

Please do not report security vulnerabilities through public GitHub issues.

To adhere to cloud-native security standards (CNCF TAG Security best practices), we enforce coordinated vulnerability disclosure:

1. Primary Secure Channel (GitHub Private Advisories): Please use the repository's native Private Vulnerability Reporting feature. Navigate to the repository's Security tab, click Advisories, and select Report a vulnerability. This allows secure, confidential communication directly with core maintainers and creation of a private staging patch before public disclosure.
2. Secondary Backup Channel: If you encounter issues accessing GitHub Private Advisories, please contact the lead maintainers directly via email at siddharthagithub0007@gmail.com or ayushpatel2731@gmail.com.

We will acknowledge receipt of your vulnerability report within 48 hours. Please adhere to the Code of Conduct during this process—public zero-day drops or harassment of maintainers over patches are strict violations of our community standards.

Based on the Infrastructure Blueprint and Master Spec, we are actively monitoring for vulnerabilities in the following planes:

• Safety Boundary Bypasses: Exploits that trick the system into classifying a NON_IDEMPOTENT_WRITE tool as PURE or READ_ONLY, bypassing the Fail-Closed default.
• Block-and-Gate Evasion: Flaws that allow an interrupted non-idempotent tool to automatically retry without explicit human/policy resolution.
• Backend Injection: Any flaw in drivers/durable-backend/dbos/ that allows arbitrary code execution outside of the locked DBOS/Restate step wrapper context.

• Seal Tampering: Vulnerabilities allowing a node payload to be mutated without breaking the RFC 8785 (JCS) + SHA256 identity hashing.
• Cache Poisoning (k8s-fluid profile): Exploits where a stale or poisoned Fluid Dataset FUSE mount can trick the runtime into bypassing the direct S3/MinIO CAS hash-verification fallback.

• Sensitive Data Leakage: Flaws where secret-like fields or thoughts leak during a redacted .tir package export.
• Package resource exhaustion: Zip bombs / oversized members must be rejected by load limits (TirLimitError).
• Unverified import: import_tir always verifies; load_tir(verify=False) is disabled. Inspection without verification requires explicit load_tir_unverified() (Python) or LoadUnverified() (Go), gated behind TRAJIR_ALLOW_UNVERIFIED=1. When allowed, a runtime warning is emitted and the call is logged at WARNING level. Unverified loads must never write to a durable NodeLog.
• Integrity vs provenance: Node hash verification proves content integrity, not publisher authenticity. Optional package signatures (trajir-pkg-sig-v1, Ed25519) prove publisher authenticity when a SIGNATURE member is present; unsigned packages remain valid by default.

• Block-and-gate races: Claiming a TOOL_CALL slot must be atomic so concurrent workers cannot double-run a NON_IDEMPOTENT_WRITE tool (R02).

• Go: govulncheck ./... runs in the CI Go job.
• Python: pip-audit --skip-editable runs in the CI job Security (pip-audit). Locally: RUN_PIP_AUDIT=1 pytest test/unit/test_pip_audit.py -q in a clean venv after pip install -e ".[dev]".

As defined in our Contributing Guidelines:

1. AI Generation Liability: If you use AI coding assistants (Antigravity IDE, Claude Code, Everything Claude Code [ECC]) to draft PRs, you, the human contributor, are 100% accountable for any security flaws they introduce. AI agents have zero built-in trust regarding security boundaries. See AI_POLICY.md for the full policy, rules, and enforcement (progressive warnings, permanent ban).
2. Mandatory Security Reviews (Procedural Governance Gate): Any pull request that modifies files in pkg/effects/ (tool safety mapping) or pkg/resume/ (block-and-gate semantics) is automatically flagged for maximum scrutiny. As a required procedural development policy, such pull requests demand peer review verification from the Security-Review Agent and explicit manual sign-off from a human core maintainer prior to merge.

Thank you for helping keep Trajectory IR safe and verifiable!