Security

Copied from SECURITY.md in the repo. The repo is the source of truth.

01REPORT A PROBLEM

Tell us privately on GitHub Security Advisories. Do not open a public issue for a flaw that can be used to attack. We reply within 7 days.

Kineti runs model-chosen commands on your machine. These are in scope:

Tools escaping the project folder, including symlink tricks
Model following instructions hidden in untrusted content that lead to tool use
Tampered logs that still pass the hash check
Spend limit bypass (reserve races, lock problems)
Daemon socket attacks: .kineti/kineti.sock must stay 0600
Token theft: ~/.kineti/auth/* must stay 0600 and never appear in logs or child process setup
Worktree delete going outside .kineti/worktrees/<id>

We list these up front so you can decide:

Shell has your user permissions — bash runs with your user rights inside the project folder. There is no extra sandbox yet (planned: system sandbox profiles). Swarm workers are also not sandboxed inside their folders — safety comes from separate folders and git merge, not from the OS.
Input screening is pattern matching — Checking for instruction-like lines uses pattern matching, not a second model.
Network is not blocked — Network access for child processes is not blocked.
Tokens depend on your account safety — Tokens on disk are only as safe as your user account. If the whole machine is compromised, the tokens can be read like any other file.
Daemon socket is same-user only — The daemon socket is 0600 (same user only). It does not stop malware already running as your user.

Use Kineti to reduce risk and keep proof — not as a hard wall against a fully compromised machine.