Report vulnerabilities privately through GitHub Security Advisories. Do not include real credentials or private repository data in reports, and do not open public issues for unpatched vulnerabilities.

ESF is under active development. Only the latest release and the latest commit on master receive security fixes. Go 1.27.1 is the pinned supported toolchain. Dependency and toolchain minimums may increase when a security fix requires it.

Machinist runs configured coding commands with the operating-system permissions, tools, environment, and credentials of the worker host user. Command prompts, executor commands, repository mappings, and worker configuration are trusted operator policy. A submitted work prompt is untrusted input, but the selected command can still act on it using every capability available to its process.

The control plane binds only to loopback. Browser requests use a random CSRF token, while CLI and worker requests use a shared bearer token. A managed worker may connect to a non-loopback control plane only over HTTPS. Do not expose the control plane through an untrusted proxy or network boundary.

Repository mappings constrain Machinist assignment and path resolution. They do not sandbox a command from other files or tools available to the worker OS user. Use OS permissions, repository permissions, and narrowly scoped credentials to enforce capability boundaries.

Machinist state defaults to ~/.machinist. Protect this directory because it may contain task prompts, command output, control-plane state, bearer tokens, repository paths, and unpublished work. Configuration and token files should remain readable only by the worker host user.

Provider CLIs own their credentials. Machinist does not request or persist provider API tokens.

See ARCHITECTURE.md for the implemented security boundaries.

The factory runs coding agents in CubeSandbox microVMs. Temporal authentication, encrypted workflow payloads, evidence storage, credential provisioning and operational boundaries are described in the deployment guide.

Candidate source, task prompts and evidence can contain unpublished work even when they contain no detected credentials. Keep the database, object store, exports and integration-test artifacts private. Secret detection is a defense in depth, not a guarantee that arbitrary content is safe to publish.

V1 readiness statements are unsigned and must be obtained from the trusted authority. They do not authorize deployment or establish regulatory compliance.