ochenstarik/hermes-hub
1
0
Fork 0
Code Issues Pull requests Projects Releases 13 Packages Wiki Activity Actions
hermes-hub/docs/SECURITY.md

1 KiB
Raw Blame History

Hermes Hub — Security Policy & Controls

1. Security Invariants

  1. Zero Secret Leaks: All credentials, tokens, and OAuth keys reside solely in %LOCALAPPDATA%\hermes\ and are excluded from Git via .gitignore.
  2. Policy Enforcement:
    • WebPolicy: Outbound URL traffic is restricted to verified provider domains. Requests to internal cloud metadata IP 169.254.169.254 or local networks are blocked.
    • ToolPolicy: Commands matching destructive patterns (format, rmdir /s /q c:\, del /f /s /q c:\windows) are blocked before invocation.
  3. Process Sandboxing & Registry:
    • Every background process spawned by the hub is tagged with a unique UUID, PID, and spawn timestamp in LifecycleSupervisor.
    • Cleanup is strictly limited to verified owned processes. Generic taskkill or killall commands are prohibited.
  4. Audit Logging:
    • Security-relevant events (URL blocking, credential operations, role changes) are appended to %LOCALAPPDATA%\hermes\logs\hermes-hub.log and displayed in the Event Log.