Security Policy & Governance Posture
Supported Version: 1.0.x
Order Samurai is designed to secure agentic coding workflows. We take the security of our governance layer and the security of your agent fleet seriously.
1. Reporting a Vulnerability
If you discover a potential security flaw, prompt-injection bypass, secret scrubber leak, or security gate bypass in Order Samurai:
- Email us directly at
support@agentica.biz.
- Include details: Steps to reproduce, agent runtime used (Claude Code, etc.), tool inputs/outputs, and sample logs if safe to share.
- Response timeline: We acknowledge receipt within 24 hours and aim to provide a triage decision and patch within 72 hours.
2. Security Guarantees & Architecture
- Data Boundary: Zero external cloud telemetry. All metric aggregation, secret scrubbing, and kill-chain analysis happen on your local filesystem (
~/.samurai/).
- Fail-Closed Gate Enforcement: Security gates block on failure (
BUSHIDO_FAIL_OPEN=false).
- Secret Scrubbing: Real-time PostToolUse and PreToolUse hooks inspect stdout, file edits, and agent outputs to prevent credential/IP leakages (ATT&CK Chain 14).
- Prompt Injection Defense: Dual-layer pattern matching + local model scoring intercepts indirect prompt injections (ATT&CK Chain 13).