hermes-hub/docs/SECURITY.md

12 lines
1 KiB
Markdown

# Hermes Hub — Security Policy & Controls
## 1. Security Invariants
1. **Zero Secret Leaks**: All credentials, tokens, and OAuth keys reside solely in `%LOCALAPPDATA%\hermes\` and are excluded from Git via `.gitignore`.
2. **Policy Enforcement**:
- `WebPolicy`: Outbound URL traffic is restricted to verified provider domains. Requests to internal cloud metadata IP `169.254.169.254` or local networks are blocked.
- `ToolPolicy`: Commands matching destructive patterns (`format`, `rmdir /s /q c:\`, `del /f /s /q c:\windows`) are blocked before invocation.
3. **Process Sandboxing & Registry**:
- Every background process spawned by the hub is tagged with a unique UUID, PID, and spawn timestamp in `LifecycleSupervisor`.
- Cleanup is strictly limited to verified owned processes. Generic `taskkill` or `killall` commands are prohibited.
4. **Audit Logging**:
- Security-relevant events (URL blocking, credential operations, role changes) are appended to `%LOCALAPPDATA%\hermes\logs\hermes-hub.log` and displayed in the Event Log.