Prompt injection
Text from pages and files is data, labelled untrusted. It cannot approve, widen budgets, change allowed domains or reach a secret.
Security model
Ogun runs code, calls models and can reach logged-in sources. The design assumes any agent, page or operator might be wrong or hostile, and limits what each can do.
Invariants
Statements the implementation must keep true. docs/IMPLEMENTATION_STATUS.md in the repository says which have a test and which are only built.
| Invariant | How it holds |
|---|---|
| Ogun never holds browser session material | Its engine is built with a null session provider; logged-in sources go through zeusd as a service client |
| No agent-reachable path can approve | Approvals are decided only on trust surfaces; MCP and A2A can raise, never answer |
| Approvals bind to exact facts | Request hash over the JCS facts; a changed workflow or budget needs a new approval |
| Code never runs in the daemon | Adapter, code and model operators are child processes with a declared profile. The sandbox is bubblewrap on Linux; Windows has none yet and refuses code operators unless allow_unsandboxed is set |
| Secrets never reach logs, events, lineage, errors or prompts | Zeroizing types, no serialization of secret types, URL redaction, canary-based leak tests |
| Benchmark runs are sealed | Network denied by default; no access to stores, zeusd or sessions |
| The daemon has one local endpoint | No network listener in ogund; ogun-server is a separate process and the hub’s listener |
Threats considered
Malicious operators
Pinned by content hash, reviewed on change, sandboxed at run time. A new or changed code hash is a plan diff a person must approve.
Data poisoning
Lineage records which run, node and operator produced an artifact, so contaminated outputs can be traced to their source.
Credential theft
Data-source credentials stay local and zeroized; browser sessions never enter Ogun at all.
Runaway spend
Model spend is counted in a hash-chained ledger and enforced per run; a larger budget in a new version needs a person. Budgets for bytes, files and time are declared but not yet enforced by the executor.
Supply chain
Operators are pinned by version and code hash. The 0.0.1a binaries are unsigned; their SHA-256 checksums are published with the release.
Reporting a vulnerability
Please tell us privately first. Our security policy explains scope, response times and safe harbour; security.txt has the contact.
Read the design
The decisions and first-draft specifications are public, and the runtime is being tested. Feedback is most useful now, before the contracts are frozen.