bastion-agent/SECURITY.md

Security policy

Reporting a vulnerability

Please do not open a public issue for a security problem.

Email security@privatae.ai with:

• the agent's version (python3 bastion-agent-<version>.pyz --version) and platform,
• what you found and how to reproduce it,
• what an attacker could do with it.

You will get an acknowledgement within three business days. We will keep you informed as the report is confirmed and fixed, and credit you in the release notes if you wish.

What is in scope

This repository: the bastion agent and the .pyz it is built into. The agent reads a person's files, so anything that lets it read, keep or give out more than its signed manifest and the person's grant allow is in scope. For example:

• The walk reading outside the manifest's roots (through a link, a junction, a path trick), or descending into an excluded directory.
• The extractors (including the built-in PDF and Office readers) being made to exhaust memory or time past their limits, to run a program other than the named tools, or to write outside the output directory.
• The sanitizer (pii/) writing personal data it found into the sanitized store, an index or a summary; a recall failure that does not stop the stage; a value reachable from a token without the local vault; the vault readable by another user.
• The embedder and the summarizer sending text that has not been sanitized to a model.
• The catalog and the sealed bundle carrying a value, the extract store, the vault or the vectors; a bundle readable by anyone but the owner and the manifest's recipients.
• serve answering a client whose certificate does not chain to the configured root, giving a grantee more than its grant or anything after its expiry, returning plaintext instead of sanitized text, or continuing to serve after the manifest stops verifying.
• The manifest gate accepting an unsigned, edited or foreign manifest, or a certificate that does not chain to the configured root.
• The artifact: a .pyz that is not what this source builds, or a weakness in verify_release.py that makes a mismatched build or a bad signature pass.

What is out of scope

• The bastion, which installs, updates and supervises the agent, signs its manifest and holds its keys. It is a separate program with its own policy: the bastion's SECURITY.md. Report there, or to the same address.
• The Host the bastion connects to, which is separate software. A C-Series Host runs on your own machine, in its own Linux virtual machine; its source is Privatae/cseries, under AGPL-3.0-only, npx cseries installs the bastion beside it and pairs, anchors and enrols it, and no Privatae account is needed. C-Series Cloud (a Host on a server of its own that Privatae sets up and keeps patched) and a Privatae network membership are optional and paid. A Host on Privatae's own platform is the case where the Host's software is not open source; the bastion keeps it to your grant and your approvals whatever the platform does. Reports about a Host sent to the address above are forwarded.
• What the design already says it does not do. The rules-only flag mode, which is the mode the bastion deploys, does not find names, street addresses or dates of birth (README), and the recall pass of sterilize mode is probabilistic (docs/pii-sterilization.md); the extract store in the output folder is plaintext by design (docs/runtime.md); the vault is not encrypted at rest. A report that shows one of these is worse than documented is in scope.
• Findings that need the owner's account already. The agent runs as the person whose folder it reads; someone who can act as that person can read the folder without it.

Supported versions

Only the current release receives fixes: the version https://privatae.ai/bastion-agent/version.json names. While a folder is shared, the bastion checks that signed manifest every ten minutes and installs any newer version, so a fixed release reaches every machine running the agent without anyone installing it. bastion_agent/VERSION on main may be ahead of the published version; see CHANGELOG.md.

Checking what you run

Every release manifest is signed with the bastion's release key (the bastion's SECURITY.md says how that key is held and what trusting it means), and the build is reproducible. python3 -m bastion_agent.verify_release checks the signature against the pinned keys, rebuilds the published version from this source, and compares the bytes; see the README.