Last Updated: September 2026
Version: 1.0

Tokenectomy Razor is architected with uncompromising security-first principles for handling sensitive infrastructure logs, stack traces, and credentials:

• Linear-Time Regex Evaluation: All pattern matching executes via Rust's guaranteed linear-time finite automaton regex engine—immune to catastrophic backtracking.
• Hardware-Audited Proof: 50,000-character malicious pathological payloads evaluated in 1.44 ms with zero memory spikes (verified in release benchmark suite).
• Guaranteed Bound: Rust's regex crate uses finite automata (DFA/NFA) providing strict linear-time guarantees $O(N)$ with respect to input length, preventing algorithmic complexity attacks and ReDoS vulnerabilities.

• Redaction Prior to Parsing: Raw error logs and stack traces are scrubbed for credentials before context extraction and AST processing, ensuring secrets never enter memory ASTs or prompt representations.
• Zero Cloud Leakage: All regex scanning and sanitization occurs 100% locally on your machine or private CI runner before any prompt or context is shared.
• Redaction Patterns:
  • AWS Access Keys & Secret Keys (AKIA..., aws_secret_access_key)
  • GitHub / GitLab / Gitea Personal Access Tokens (PATs)
  • OpenAI, Anthropic, and generic AI API keys (sk-...)
  • PostgreSQL, MySQL, Redis, MongoDB connection URIs
  • Slack & Discord Webhooks / Bot Tokens
  • JSON Web Tokens (JWTs) (eyJ...)
  • SSH / RSA / Ed25519 Private Keys
  • Database passwords and auth headers

• Centralized WorkspaceBoundary: All filesystem operations (read, write, resolve, and context extraction) are mediated through a single, strict security boundary.
• Canonicalized Path Traversal Immunity: Target paths and workspace roots are strictly canonicalized. Directory escapes (../), null-byte injection (\0), and out-of-boundary symlink traversals are rejected before any I/O occurs.

• Fail-Safe Patching (apply_code_patch): Any patch applied by autonomous agents creates an in-memory backup state and immediately triggers language-specific syntax validation (cargo check, py_compile, node --check).
• Deterministic Auto-Rollback: If syntax or compilation verification fails, the original file is instantly restored, guaranteeing 0 dirty diffs in version control.

• Loopback Default Invariant: Reverse proxy binds strictly to local loopback (127.0.0.1, [::1]) by default.
• Mandatory Remote Auth: Binding to external interfaces (0.0.0.0) requires explicit --allow-remote flag AND a mandatory proxy bearer token (--proxy-token or TOKENECTOMY_PROXY_TOKEN).
• Resource Bounds & DoS Resistance: Strict upper limits enforced: MAX_HEADER_SIZE (64 KB), MAX_BODY_SIZE (10 MB), client/upstream timeouts (30s / 60s), and concurrency throttling via asynchronous permits (max 128 concurrent connections).

• Pure Rust Guarantee: Zero buffer overflows, use-after-free, or data races guaranteed by the Rust compiler.
• Zero Unsafe Code: No unvetted unsafe blocks in trace parsing, workspace boundaries, or redaction paths.

• SHA-256 Cache Keying: Content hashes and response caches use SHA-256 (not vulnerable non-cryptographic hashers).
• Secure File Permissions: Temporary caches enforce strict POSIX permissions (0700).

• Advisory Declarative Metadata: Control-plane fields are declarative advisory hints, not imperative instructions, to avoid resembling prompt-injection patterns and to keep the control envelope safe for consumption by third-party agents with independent reasoning.
• Explicit Advisory Disclaimer: Every emitted control envelope explicitly specifies [ADVISORY_ONLY=true].
• Non-Imperative Field Vocabulary: Directives are framed without imperative verbs ([SUGGESTED_NEXT_FRAME=<file:line>] rather than imperative action commands like INSPECT_CALLER_AT_), ensuring static security scanners, enterprise tool-safety audits, and client-side prompt-injection classifiers do not flag M2M telemetry as adversarial execution directives.

• Independent Third-Party Custody: Tokenectomy Razor is open-source software provided under the MIT License exclusively for defensive observability, crash log sanitization, token budgeting, and developer productivity.
• Zero Liability for Downstream Abuse: Any third-party fork, clone, private deployment, modified binary, or derivative work operates completely outside the custody, telemetry, and control of Tokenectomy Labs and its maintainers. Under no circumstances shall the original author (@daffa2555), Tokenectomy Labs, or contributors be held liable or legally responsible for any illegal, unlawful, malicious, abusive, or unauthorized acts committed by downstream users or fork operators.
• Sole Operator Liability: Downstream users, fork maintainers, and individual operators assume 100% personal, commercial, and legal accountability for their usage and compliance with all applicable cybercrime, privacy, and intellectual property laws. See DISCLAIMER.md for complete details.

Do NOT open a public GitHub issue for security vulnerabilities.

1. GitHub Security Advisory (Recommended):
   👉 Open a Private Security Advisory
2. Direct Maintainer Contact:
   Contact maintainer directly via GitHub profile: @daffa2555.

• Detailed description of the vulnerability.
• Minimal reproducible proof of concept (PoC).
• Affected version(s) of Tokenectomy Razor.
• Impact assessment (e.g. potential for secret leakage, denial of service).

• Initial Acknowledgment: Within 24 hours.
• Triage & Assessment: Within 48 hours.
• Patch Release: Within 72 hours for Critical/High severity.
• Public Advisory: Coordinated disclosure after fix release.

1. Keep Tokenectomy Updated:

   cargo install --force tokenectomy

2. Surgically Scrub CI Logs Before LLM Triage:

   - name: Sanitize Failure Logs
     if: failure()
     uses: Tokenectomy-Labs/Tokenectomy@v1
     with:
       log-file: 'build.log'
       output-file: 'sanitized.log'

3. Audit Local MCP Config: Ensure AI agent configurations pass explicit workspace directory boundaries.

   Raw Error Dump / Stack Trace
               ↓
 ┌────────────────────────────────────────┐
 │   Tokenectomy Razor (Local Engine)     │
 │   ├─ Polyglot Stack Extractor          │ ➔ Strips node_modules, site-packages, etc.
 │   ├─ Deterministic Secret Redactor     │ ➔ Redacts AWS, PATs, JWTs, DB URIs
 │   └─ SHA-256 Fast Response Cache       │ ➔ 0700 Local Permissions
 └────────────────────────────────────────┘
               ↓
   Sanitized Context (2K–10K Tokens)
               ↓
   Safe Transmission to LLM Brain / Issue Tracker

Key Security Invariant: Secrets never cross the boundary from local sanitization to external systems or AI context windows.

Developers can independently verify all security properties on their physical hardware:

# Verify dependency security
cargo audit

# Verify secret redaction on live fixtures
cargo test test_redact -- --nocapture

# Verify ReDoS immunity under pathological load
cargo test --release test_redos_immunity -- --nocapture

# Full release verification suite
cargo test --release

We publicly credit and thank all security researchers who report vulnerabilities responsibly through our private channels.

Tokenectomy Razor — Uncompromising context safety and secret redaction for autonomous AI agents.