Do not open a public GitHub issue for security vulnerabilities.

Please open a private security advisory on GitHub rather than a public issue. This keeps details confidential until a fix is available.

Include in your report:

• Description of the vulnerability
• Steps to reproduce
• Affected versions
• Potential impact assessment
• Any suggested mitigations

You will receive acknowledgment within 48 hours. We aim to release a fix within 14 days for critical issues and 30 days for moderate issues.

Note: A dedicated security contact email will be published once the project reaches beta. Until then, GitHub private advisories are the authoritative reporting channel.

arasaka is a runtime safety layer for AI agents. The threat model assumes:

• Untrusted LLM output — the LLM is treated as an untrusted proposer. Its output (tool calls, claims, draft) is validated, sandboxed, and policy-checked before execution.
• Prompt injection — user inputs are sanitized; detect_prompt_injection = true in config.
• Taint tracking — RAG document content is marked [UNTRUSTED REFERENCE] to prevent it being treated as trusted instructions.
• SSRF — HTTP tool calls are validated against allowed_domains and block_private_networks.
• Secret redaction — sensitive values are redacted from traces and logs when redact_secrets = true.
• Tenant isolation — all stores, memory, and runs are scoped by tenant_id.
• Approval gates — high-risk tool calls require human approval before execution.

• Browser tool — ChromiumoxideBrowserTransport (feature browser) requires Chrome or Chromium installed at runtime. MockBrowserTransport is used in tests and when the feature is disabled.
• WASM sandbox — WasmSandbox (feature wasm-sandbox) evaluates WASM policy modules with fuel limits. It is a policy-enforcement gate, not a general-purpose sandboxed execution environment.
• Container sandbox — DockerContainerSandbox (feature container-sandbox) enforces an image allowlist at preflight. Actual container spawning is delegated to the tool executor.
• Grounding — citation-based only; no NLI model for semantic entailment checking.
• OTLP — trace export to collectors is experimental; stdout fallback is the default.

cargo audit

We recommend running cargo audit as part of your CI pipeline.