Built so that nothing can talk its way past the gate

The release decision

• Promotion is decided by deterministic code from persisted evidence. No model output is ever an input to the verdict.
• Missing or inconclusive evidence is reported as such and blocks when a rule is mandatory.
• Each decision stores the SHA-256 digest of the exact policy profile that produced it. Evidence bundles carry their own digest and a validator detects tampering.

Agents and untrusted content

• Merge request text, commits and source files are treated as data. Instruction-like text (“ignore previous instructions…”) is flagged into the audit trail and has no effect.
• Agent hypotheses must pass a strict schema. They can only reference scenarios in an allowlisted registry; anything else is recorded as not tested and never executed.
• Experiments run in child processes with a scrubbed environment (no inherited tokens), per-scenario timeouts and path checks that keep every write inside a per-run sandbox.
• Patches apply only as exact single-match edits to validated relative paths. Packages are re-verified by digest before deployment, with zip-slip protection.

Accounts and sessions

• Passwords are hashed with scrypt and a per-user salt. Sign-in errors don’t reveal whether an account exists, and sign-in, sign-up and reset requests are rate-limited.
• Sessions use 256-bit random tokens in HttpOnly, SameSite=Lax cookies (Secure with HSTS behind HTTPS). Only a SHA-256 of each token is stored. Changing your password signs out every other session.
• Cookie-authenticated changes require a custom header that browsers can’t send cross-site without a CORS preflight, and CORS only allows configured origins.
• Password-reset and invite links are single-use, expire, and are stored only as hashes.

Workspaces and access

• Every run, artifact and evidence endpoint checks workspace membership. Records from other workspaces return 404, so their existence isn’t disclosed.
• Roles: owner, admin, member, viewer. Admins can’t change owners, and a workspace can’t lose its last owner.
• API keys are scoped to one workspace and one role, shown once, stored as a hash, and revocable instantly.

Platform

• Strict security headers: Content-Security-Policy, frame denial, nosniff, and a strict referrer policy. API responses aren’t cached.
• Per-client API rate limiting and a 1 MB request body cap. Errors return a request ID and never a stack trace.
• CI deploys to Google Cloud with Workload Identity Federation (GitLab OIDC), with no stored service-account keys.

Known limitations

• Locally, experiment processes run as the same OS user. Use the container image (non-root) for stronger isolation.
• The audit trail is append-only by convention, not cryptographically chained.
• The GitLab Duo flow’s run_command tool is a general shell inside GitLab’s sandbox. The prompt limits it to the bounded CLI; the enforced limits are the sandbox, its network policy and the triggering user’s permissions.

Found a vulnerability? Please report it privately to the project maintainers through the repository’s issue tracker with confidential visibility.