Skip to content

Security Policy

Supported Versions

Version Security Updates
1.x ✅ Active
< 1.0 ❌ End of life

Reporting a Vulnerability

Do not open a public GitHub issue for security vulnerabilities.

Please email security@virtualsutra.com with:

  • Description of the vulnerability
  • Steps to reproduce
  • Potential impact assessment
  • Any suggested fix (optional)

We aim to acknowledge reports within 48 hours and provide a resolution timeline within 7 business days.

Security Design Principles

  1. Zero credential persistence - Raw secrets are never stored in code, logs, config files, or the state store
  2. Read-only cloud access - All inspection API calls are read-only; enforced at IAM level
  3. Isolated execution - Production agents run in containers with dropped capabilities and read-only filesystems
  4. LLM data minimization - Only sanitized metadata is sent to external LLM APIs; never raw customer data
  5. Immutable audit trail - Every action is recorded in an append-only JSONL log
  6. Only the console acts for a user - The API accepts a signed actor assertion only from the key named in CONSOLE_API_KEYS. If none is named, it accepts none, and under SaaS the API does not start unless API_NO_CONSOLE=true declares that there is no console. GET /health reports console_identity. (platform#538)