Consequent is an alpha. Do not expose it directly to the public internet without a reverse proxy, TLS, API keys, and network-level access controls.
Current security controls:
- Optional API key enforcement through
CONSEQUENT_API_KEYS - Consequent-owned executor registry
- Deterministic policy checks before execution
- Tamper-evident ledger hash chain
- Idempotency keys for safe retries
Recommended production controls:
- Put the service behind TLS.
- Set
CONSEQUENT_API_KEYS. - Restrict network access to trusted agents.
- Use a managed database with backups.
- Register only audited executor plugins.
- Keep human approval required for irreversible external actions.
Report vulnerabilities by opening a private security advisory on GitHub when the repository is available.