Security Architecture

Twelve critical files — including lint configurations, CI pipeline definitions, deployment scripts, and security exception registries — are protected by a SHA-256 hash chain. Each chain entry records the cryptographic hash of the protected file set, creating a tamper-evident audit trail. Unauthorized modifications to any protected file are detected automatically during verification.

The codebase enforces 980 Rust compiler and Clippy lints at the forbid level and 21 additional lints at the deny level. Lint suppressions (#[allow(...)]) are prohibited project-wide; exceptions require registration in a tracked exception file that is itself part of the hash chain. This prevents silent introduction of unsafe patterns.

Automated CI and pre-commit callbacks enforce a maximum of 500 lines per source file and 8 entries per directory. These constraints promote code modularity and ensure that security-sensitive logic is isolated into reviewable units rather than embedded in large, complex files.

Security vulnerabilities should be reported through GitHub's Security Advisory feature. Reports are triaged promptly. Critical vulnerabilities affecting data confidentiality or integrity are prioritized for patch release within the current development cycle.

GitHub Dependabot monitors all dependencies (Rust crates and npm packages) for known vulnerabilities. CodeQL static analysis runs on every push and pull request to the main branch, detecting common vulnerability patterns including injection flaws, path traversal, and unsafe memory operations.

Release binaries are built exclusively through the CI/CD pipeline (GitHub Actions) from the audited source tree. Build artifacts are published as GitHub Releases with provenance metadata. The release workflow is itself a protected file within the hash chain, preventing unauthorized modifications to the build process.

All Rust dependencies are pinned via Cargo.lock (committed to version control). All JavaScript dependencies are pinned via pnpm-lock.yaml. Both lockfiles are tracked in the repository, ensuring bit-for-bit reproducible builds across environments and time. No floating version ranges are used for production dependencies.

OpenSSL is compiled from vendored source (openssl-src crate with the vendored feature flag) rather than linked against system-installed versions. This eliminates dependency on the host system's OpenSSL installation, prevents version mismatches, and ensures a known-good cryptographic library is included in every build regardless of deployment environment.

GitHub Dependabot continuously monitors both the Rust crate dependency tree and the npm package dependency tree for known vulnerabilities. Security advisories trigger automated pull requests with updated dependency versions. Critical and high-severity advisories are reviewed and addressed within the current development cycle.

All direct and transitive dependencies use permissive open-source licenses (MIT, Apache 2.0, BSD, ISC, Zlib). No copyleft (GPL, LGPL, AGPL), proprietary, or otherwise restrictive licenses exist in the dependency tree. This is verified periodically and can be independently reproduced by any party using the committed lockfiles.

Context Pilot does not listen on any network-accessible port by default. The orchestration backend binds exclusively to the loopback interface (127.0.0.1:7878), making it unreachable from the network. The Meilisearch sidecar similarly binds to loopback only. No port forwarding, firewall rules, or network configuration is required or recommended.

Every outbound network connection is attributable to a specific, operator-configured service integration. The complete list of possible outbound destinations is documented in the Subprocessor Register. No connection is made to any endpoint not explicitly configured by the operator. There are zero "phone home," analytics, crash reporting, or update-check connections.

The localhost HTTP server is protected against confused-deputy attacks (malicious websites making requests to localhost:7878 via the user's browser) through a single-use, time-limited ticket system. SSE stream connections require a ticket minted by a prior authenticated REST call. Tickets are cryptographically random (256-bit, /dev/urandom), expire after 30 seconds, and are consumed on first use. This defense is necessary because CORS alone cannot prevent DNS rebinding attacks against localhost services.

All file system operations exposed through the HTTP API are confined to the agent's project directory ("realm"). A confined_path() function canonicalizes and validates every path parameter, rejecting any request that would access files outside the designated directory. This prevents directory traversal attacks via ../ sequences, symlinks, or encoded path separators. Violations return HTTP 403.

Security vulnerabilities should be reported via GitHub Security Advisories. This provides a private, encrypted channel for vulnerability discussion between the reporter and the maintainers. Do not report security vulnerabilities through public GitHub Issues.

Upon receiving a security report, the maintainers will:

• Acknowledge receipt within 48 hours
• Provide an initial assessment of severity and impact within 5 business days
• Develop and release a fix for confirmed critical/high-severity vulnerabilities within the current development cycle
• Coordinate public disclosure with the reporter after a fix is available
• Credit the reporter in the security advisory (unless anonymity is requested)

The following are in scope for the vulnerability disclosure program:

• Path traversal vulnerabilities in the file system API
• Authentication/authorization bypasses in the SSE ticket system
• Credential exposure through logging or persistence
• Denial of service vulnerabilities in the orchestration backend
• Remote code execution through any input vector
• Supply chain attacks via compromised dependencies
• Information disclosure of sensitive data (API keys, conversation content)