Security

SECURITY.md

Security Policy — Tudex-Agent-Automator (TAA)

Supported Versions

Only the latest release and current development branch of Tudex-Agent-Automator are supported with security updates.

Version	Supported
3.x	✅
< 3.0	❌

Reporting a Vulnerability

If you discover a security vulnerability within Tudex-Agent-Automator, please report it privately:

Do NOT open a public issue on GitHub.
Email the maintainer or submit a private report with:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
We will respond within 48 hours to acknowledge the report and provide an estimated timeline for remediation.

Security Practices in TAA

1. API Key & Vault Management

Never commit credentials: .env, .keys.json, and .jules-usage.json are excluded via .gitignore.
Masking: API key secrets are truncated (••••<last4>) in UI views and CLI output logs.
Rotation & Rate Limiting: The built-in KeyManager enforces daily session quotas per API key to prevent quota exhaustion and abuse.

2. Autonomous PR & Auto-Merge Guardrails

GitHub Status Check Enforcement: TAA verifies that all GitHub Actions CI/CD checks pass (success) before executing an automated merge.
No Unvalidated Merges: If any CI test fails, the PR is held in review and requires manual approval.

3. Container & Runtime Security

Isolated Execution: Services (taa-engine, taa-cron) run in unprivileged Docker containers.
ReadOnly Volume Mounts: External repository mounts for local analysis are configured as read-only (:ro) to prevent unauthorized local file modification.

There aren't any published security advisories