Security Policy & Governance Posture

Order Samurai is designed to secure agentic coding workflows. We take the security of our governance layer and the security of your agent fleet seriously.

1. Reporting a Vulnerability

If you discover a potential security flaw, prompt-injection bypass, secret scrubber leak, or security gate bypass in Order Samurai:

1. Report privately through GitHub private vulnerability reporting or security@ordersamurai.ai. Do not post secrets in public issues.
2. Include details: Steps to reproduce, agent runtime used (Claude Code, etc.), tool inputs/outputs, and sample logs if safe to share.
3. Response timeline: We aim to acknowledge within 24–48 business hours. This is a target, not a staffed response guarantee; triage and patch timing depend on severity and investigation.

2. Security Guarantees & Architecture

• Data Boundary: Local analysis by default, with no product telemetry collected by Order Samurai. Optional third-party AI review transmits review content only after explicit opt-in; license activation contacts Gumroad.
• Guard Failure Behaviour: On Cursor and Gemini CLI the prompt-injection guard fails closed: an internal error or unreadable input blocks the tool call. On Claude Code and Codex it fails open: a guard crash or malformed payload lets the call through. Pattern blocks themselves are deterministic.
• Secret Detection: On Claude Code, a PostToolUse hook scans Bash and Read output for credentials and logs each detection (kill-chain 14). It does not redact what the agent receives, and it is not installed for Codex, Cursor or Gemini CLI.
• Prompt Injection Defense: A pre-tool hook blocks tool calls whose input matches known prompt-injection patterns (kill-chain 13). Softer matches are logged; an optional local-model second look runs on localhost only and fails open. It does not block destructive shell commands.