Rig Relay is local-first software. Most security concerns relate to local tool execution boundaries, credential handling, and debug packet quarantine.
Do not report vulnerabilities, leaked secrets, or exploit details in public issues, public discussions, or chat logs.
Report vulnerabilities privately through GitHub Security Advisories: https://github.com/juliantorr-es/rig-relay/security/advisories/new
If private reporting is unavailable in your environment, open a minimal public issue without sensitive details and request a private follow-up channel.
| Version | Supported | Scope |
|---|---|---|
| 0.1.0a1 | ✅ | Current alpha release candidate |
| 0.1.x (alpha) | ✅ | Best-effort security fixes during alpha line |
Rig Relay executes tools and subprocesses on your local machine. The following boundaries are enforced:
- All destructive Git commands are blocked by the governance guard.
- Bash commands are scanned for dangerous patterns before execution.
- Environment variables are scrubbed before subprocess execution.
- Debug bundles are created only by explicit user action (dry-run by default).
- API keys use OS-native credential storage when available, with local fallback.
- Tokens and secrets are redacted from telemetry, traces, and debug bundles.
- No credentials are transmitted without explicit user consent.
See docs/governance/ for detailed architecture documentation.