SECURITY.md says nothing about trust boundaries, user-held credentials, or transcripts #5

New Issue

Closed

opened 2026-08-17 22:51:05 -05:00 by null · 0 comments

null commented

2026-08-17 22:51:05 -05:00

Owner

Three gaps in docs/security/SECURITY.md, all of which matter more in an agent-built portfolio than a hand-written one.

Untrusted text. Nothing states that text arriving from outside the trust boundary -- user content, repository text, third-party API responses, model output -- is data and never instructions, and never reaches a model without a delimiter and redaction. PrivacyLLC-Web's notices worker is the reference implementation and can be cited.

Whose secrets these are. Every sentence in the Secrets section assumes the secret is ours. A project holding credentials on behalf of its users -- bring-your-own-key, a linked account, a stored third-party token -- has an asset class the document does not describe. (precautionary): nothing here has been bitten by this yet.

Transcripts. A credential pasted into an agent transcript to debug something is a leaked credential and rotation is the only fix. secrets.sh cannot see transcripts and never will, which is exactly why this has to be a written rule rather than a check.

Verify: docs/security/SECURITY.md carries all three -- an outside-text-is-data section, user-held credentials named in the Assets prompt, and the transcript rotation rule in Secrets.

Three gaps in docs/security/SECURITY.md, all of which matter more in an agent-built portfolio than a hand-written one. **Untrusted text.** Nothing states that text arriving from outside the trust boundary -- user content, repository text, third-party API responses, model output -- is data and never instructions, and never reaches a model without a delimiter and redaction. PrivacyLLC-Web's notices worker is the reference implementation and can be cited. **Whose secrets these are.** Every sentence in the Secrets section assumes the secret is ours. A project holding credentials on behalf of its users -- bring-your-own-key, a linked account, a stored third-party token -- has an asset class the document does not describe. *(precautionary)*: nothing here has been bitten by this yet. **Transcripts.** A credential pasted into an agent transcript to debug something is a leaked credential and rotation is the only fix. secrets.sh cannot see transcripts and never will, which is exactly why this has to be a written rule rather than a check. Verify: docs/security/SECURITY.md carries all three -- an outside-text-is-data section, user-held credentials named in the Assets prompt, and the transcript rotation rule in Secrets.