AlphaForge is a desktop-first AI workspace for investment research. Our security model is built on the following principles:

• API keys and credentials are stored in the OS keychain (not in plaintext)
• Secrets are never exposed to the React frontend
• Credential access requires explicit user permission

• All data is stored locally in SQLite
• No data is sent to external servers without explicit user action
• Network requests are validated and logged

• Plugins run in isolated environments
• Permission model restricts plugin capabilities
• Manifest validation prevents unauthorized access

• Agent-generated content is rendered in isolated WebViews
• Artifacts cannot access main application privileges
• Input validation prevents injection attacks

• All IPC inputs are validated with Zod (TypeScript) and Serde (Rust)
• File paths are normalized and checked for directory traversal
• URLs are validated against an allowlist

Do NOT open a GitHub issue for security vulnerabilities.

Instead, please report security issues privately:

1. Email: Send details to [security@alphaforge.dev] (replace with actual email)
2. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

• Acknowledgment: Within 48 hours
• Initial Assessment: Within 7 days
• Fix Timeline: Depends on severity
  • Critical: 7 days
  • High: 14 days
  • Medium: 30 days
  • Low: Next release

We follow coordinated disclosure:

1. We acknowledge and validate the report
2. We develop and test a fix
3. We release the fix
4. We publicly disclose the vulnerability (after giving users time to update)

We credit reporters who follow this process (unless they prefer to remain anonymous).

1. Never commit secrets

   • Use .env files (already in .gitignore)
   • Use OS keychain for production credentials

2. Validate all inputs

   • TypeScript: Use Zod schemas
   • Rust: Use Serde + explicit validation

3. Handle errors properly

   • Never expose stack traces to users
   • Log errors with context but redact secrets

4. Follow least privilege

   • Request minimal permissions
   • Avoid shell access unless necessary
   • Validate file paths before filesystem access

5. Secure dependencies

   • Run npm audit regularly
   • Run cargo audit regularly
   • Review dependency updates carefully

Agents working on this codebase must:

1. Never generate code that:

   • Executes arbitrary shell commands
   • Reads plaintext credentials
   • Bypasses Tauri permission system
   • Injects unvalidated HTML into main window

2. Always:

   • Validate external inputs
   • Use typed IPC commands
   • Follow architecture boundaries
   • Document new security requirements

See AGENTS.md for complete agent security rules.

# .env.example
OPENAI_API_KEY=      # Stored in OS keychain, not here
DATABASE_URL=        # Local SQLite path
LOG_LEVEL=info       # Logging level

// src-tauri/tauri.conf.json
{
  "security": {
    "csp": "default-src 'self'; script-src 'self'",
    "dangerousDisableAssetCspModification": false
  }
}

• Scripts: Only from same origin
• Styles: Inline styles allowed (Tailwind)
• Images: Data URIs and same origin
• Connect: Restricted to allowed domains

1. Development Mode

   • CSP is relaxed in development
   • Debug features are enabled
   • Not for production use

2. Plugin System

   • Currently internal plugins only
   • External plugins will require sandboxing
   • Permission model in progress

3. Artifact Windows

   • Isolation implemented but not battle-tested
   • Need penetration testing before production

• Penetration testing audit
• External plugin sandboxing
• Audit logging for all privileged operations
• Biometric unlock for sensitive operations
• Encrypted database option

Before each release, verify:

• No secrets in git history (git log --all --full-history -- "*.env")
• All dependencies audited (npm audit, cargo audit)
• CSP headers validated
• Permission boundaries tested
• Error messages don't leak paths
• Logs don't contain credentials
• Update process is secured (signature verification)

• Security Email: [security@alphaforge.dev]
• Project Maintainer: Berry Wahlberg
• Response Time: 48 hours (acknowledgment)

Last Updated: 2026-07-31

For complete security architecture, see docs/SECURITY.md.