No product telemetry in 0.2.0.
The current VS Code workflow does not include Aegis product telemetry. Deterministic scans, policy evaluation, audit records, and project security memory remain local.
Security
Trust starts with clear boundaries.
Aegis is a security product. Its own public website and product documentation should state what is local, what may leave the machine, what can execute, and what a result does—and does not—prove.
Model-backed review is optional.
Deterministic workflows can run without a model provider. When enabled, Aegis records the provider and model used for each role.
Dynamic validation is never implicit.
Controlled validation is separately authorized and intended only for repositories and systems the operator owns or is explicitly permitted to test.
The VS Code extension connects to the local Aegis backend at http://127.0.0.1:8000 by default. It does not silently start a hidden service. Repository-reading and validation commands are disabled in untrusted and virtual workspaces.
Source and evidence handling
Deterministic analysis remains local. If model-backed review is deliberately configured, Aegis sends the configured provider only the source context and evidence required for that request after applying its secret-redaction boundary. The resulting report records which route handled primary review and which route handled verification.
Boundary: “local-first” does not mean “nothing can ever leave the machine.” Model-backed review is an explicit operator choice and should be evaluated against the provider’s own data terms.
The current dynamic-validation boundary is designed around explicit authorization and containment. The repository and container root are read-only; networking is disabled by default; Linux capabilities are dropped; no-new-privileges is set; execution uses an unprivileged user; and CPU, memory, process, runtime, and output limits are applied.
No shell-built container command
Aegis does not construct its container invocation through a shell string. This keeps the execution boundary narrower and avoids turning repository-controlled text into shell syntax.
Authorization remains separate
Controlled reproduction is evidence gathering. It is not a blanket right to probe external targets or production systems.
Secure fixes are bound to the reviewed patch digest and source selection. Aegis revalidates both before writing, replaces the source atomically, and is designed not to overwrite newer user work during rollback.
Verification outcomes
- VERIFIED means the configured required checks passed, the target finding disappeared, no static regression appeared, and an authorized baseline no longer reproduces.
- PARTIAL means available checks passed but the evidence is not sufficient for a verified claim.
- FAILED means the issue remains, a check failed, a regression appeared, or execution could not support a trustworthy conclusion.
A blocked, cancelled, failed, or timed-out run never becomes proof of safety.
Production runs have a task graph and append-only audit trail. Trusted Analysis binds the source, plan, audit stream, and artifact manifest with SHA-256 digests. Revision drift, source changes, missing evidence, and incomplete verification remain visible.
Project security memory stores immutable snapshots and claim transitions including new, persistent, changed, resolved, and reopened risk. Partial or failed analysis is not written as a clean baseline.
The public Aegis website is designed as a static Astro build with no login, database, server-side contact form, advertising script, or third-party analytics dependency. Production headers deny framing, restrict scripts and connections to the same origin, disable unused browser capabilities, and require HTTPS.
This is not a guarantee that any website is vulnerability-free. It is an architectural choice to remove unnecessary runtime surface and make the remaining behavior easier to inspect.
Report a vulnerability privately.
Please follow the repository security policy rather than opening a public issue for a sensitive report.