Hugging Face's logo

Dani12po
/
zevora

Text Generation
English
Indonesian
custom
coding-agent
llm-agents
local-ai
llama-cpp
hybrid-inference
python
fastapi
ai-agent
qwen3.8-flash-next
Model card Files
xet
 Community
zevora / SECURITY.md
Dani12po's picture
Dani12po
ZEVORA 0.2.0 - source distribution (sanitized release)
4d2ab8d verified
preview code
|
Raw History Blame Contribute Delete
2.33 kB

Security Policy

Reporting a Vulnerability

Please report security issues privately to the maintainers before disclosure. Open an issue only for non-sensitive bugs. Do not include secrets, API keys, or model credentials in any report.

Supported Versions

Version Supported
Current :white_check_mark:

Security Posture

ZEVORA is a local-first coding agent. This section documents the built-in boundaries that protect the host and the network.

Local model integrity

  • Local GGUF models are verified by SHA-256 before loading when an authoritative reference exists (<model>.sha256 sidecar or the managed-package manifest).
  • A mismatched digest aborts the load; the managed-package installer writes a sidecar for every package it places.
  • The agent never downloads a whole Hugging Face repository; it selects a single quantization package.

Provider request surface (SSRF)

  • Cloud provider base URLs are validated at construction time (agent/providers/ssrf.py).
  • Requests to loopback, link-local (including 169.254.169.254 cloud metadata), unspecified addresses, reserved metadata hostnames, and non-http(s) schemes are rejected.
  • Local/OpenAI-compatible loopback endpoints are a separate provider class and are not routed through this guard.

Workspace and permissions

  • File, terminal, git, and package operations are gated by the permission system.
  • Approved approvals never override workspace-boundary restrictions: paths outside the workspace are blocked even when approved.

Secrets and telemetry

  • Provider credentials are stored as environment references, never embedded in manifests or logs.
  • Telemetry and logged traces are redacted of API keys and model credentials.

Cache and memory

  • The semantic/exact cache key includes a model signature, so cached responses for one model/quantization are never replayed for another.
  • Prompt-injection defenses and output sanitization are applied to knowledge and memory flows.

Reporting Process

  1. Describe the vulnerability, impact, and reproduction steps.
  2. Maintainers will acknowledge within 5 business days.
  3. A fix is coordinated before public disclosure, unless the issue is publicly exploitable now, in which case it is disclosed immediately.