Skip to content

Security: proffesor-for-testing/agentic-qe

Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

The Agentic QE project maintains security updates for the following versions:

Version Supported Notes
1.2.x ✅ Current stable release
1.1.x ✅ Maintained with critical security fixes
1.0.x ❌ Upgrade to 1.2.x recommended
< 1.0 ❌ No longer supported

Recommendation: Always use the latest stable version (1.2.x) to ensure you have the most recent security patches and improvements.

Security Features

Built-in Security Measures

The Agentic QE framework includes several security features by default:

1. AgentDB Integration Security (v1.2.0+)

  • TLS 1.3 Encryption: All QUIC connections use TLS 1.3 by default
    • Certificate Validation: Mandatory certificate validation for all connections
      • Connection Authentication: Secure agent-to-agent communication

        • Sub-millisecond Latency: <1ms secure communication overhead

        • 2. Dependency Security

          • Regular Audits: Automated dependency vulnerability scanning
            • Minimal Dependencies: 89 packages removed in v1.2.0 (7.3MB reduction)
              • Trusted Sources: All dependencies from verified npm registry sources

                • Lock File: package-lock.json ensures reproducible builds

                • 3. Data Protection

                  • Local Storage: SQLite database stored locally (.aqe/memory.db)
                    • No External Transmissions: Learning data and patterns stay on your system
                    • Encryption at Rest: Optional database encryption for sensitive data

                    • Memory Isolation: Agent memory stores are isolated by agent ID

                    • 4. API Security

                    • Authentication: Optional API key authentication for MCP server
                    • Rate Limiting: Built-in rate limiting for API endpoints
                    • CORS Configuration: Configurable cross-origin resource sharing

                    • Input Validation: All API inputs are validated and sanitized

                    • 5. Code Security

                    • TypeScript: Strong typing prevents many common vulnerabilities
                    • No Eval: Zero use of eval() or dynamic code execution

                    • Input Sanitization: All external inputs are validated

                    • Path Traversal Protection: Safe file system operations

                      • Reporting a Vulnerability

                      We take security vulnerabilities seriously. If you discover a security issue, please follow these steps:

                      1. DO NOT Open a Public Issue

                      Security vulnerabilities should not be reported through public GitHub issues to prevent exploitation before a fix is available.

                      2. Report via Private Channel

                      Email: [email protected] Subject: [SECURITY] Brief description of issue

                      Include in your report:

                    • Description of the vulnerability
                    • Steps to reproduce the issue
                    • Potential impact and severity assessment
                    • Affected versions
                    • Any suggested fixes (if applicable)

                    • Your contact information for follow-up

                    • 3. Response Timeline

                    • | Timeline | Action |

                    • | -------- | ----------------------------------------------------- |

                    • | 24 hours | Acknowledgment of your report |

                    • | 7 days | Initial assessment and severity classification |

                    • | 30 days | Fix development and testing (for critical issues) |

                    • | 90 days | Public disclosure (after patch release) |

                    • 4. Severity Classification

                    • We use the following severity levels:

                    • CRITICAL: Remote code execution, authentication bypass, data breach
                    • HIGH: Privilege escalation, SQL injection, XSS
                    • MEDIUM: Information disclosure, denial of service

                    • LOW: Minor information leaks, non-exploitable bugs

                    • 5. Security Advisory Process

                      1. Private Fix: We develop and test the fix privately
                        1. Security Advisory: We create a GitHub Security Advisory
                          1. Patch Release: We release a patched version
                            1. Public Disclosure: We publish the advisory with details

                              1. Credit: We credit the reporter (unless they prefer anonymity)

                              3. Security Best Practices

                              4. For Users

                              5. 1. Keep Dependencies Updated

                              6. # Check for updates
npm outdated

# Update to latest stable version
npm update agentic-qe

# Audit dependencies
npm audit
npm audit fix

                                2. Secure Configuration

                                # config/fleet.yaml - Production settings
security:
  # Enable TLS 1.3 for all connections
  tlsVersion: "1.3"

  # Require certificate validation
  validateCertificates: true

  # Enable database encryption
  databaseEncryption: true
  encryptionKey: "${AQE_DB_ENCRYPTION_KEY}" # Use environment variable

  # API authentication
  apiAuth:
    enabled: true
    apiKey: "${AQE_API_KEY}" # Use environment variable

  # Rate limiting
  rateLimit:
    enabled: true
    maxRequests: 100
    windowMs: 60000 # 1 minute

                                3. Environment Variables

                                # .env - NEVER commit this file
AQE_DB_ENCRYPTION_KEY=your-secure-random-key-here
AQE_API_KEY=your-secure-api-key-here

# Use strong random keys
openssl rand -base64 32

                                4. File Permissions

                                # Secure your configuration files
chmod 600 .env
chmod 600 config/fleet.yaml
chmod 700 .aqe/

# Verify permissions
ls -la .env config/ .aqe/

                                5. AI Model API Keys

                                # Store API keys securely in environment variables
export OPENAI_API_KEY="sk-..."
export ANTHROPIC_API_KEY="sk-ant-..."

# Never hardcode in configuration files
# Never commit to version control

                                6. Network Security

                                # Restrict API access
api:
  host: "127.0.0.1" # Localhost only
  port: 3000

  # Or use specific IP whitelist
  allowedIPs:
    - "192.168.1.0/24"
    - "10.0.0.0/8"

                                7. Audit Logging

                                # Enable comprehensive audit logging
logging:
  level: "info"
  auditLog: true
  auditFile: ".aqe/audit.log"

  # Log sensitive operations
  auditEvents:
    - "agent_spawn"
    - "database_access"
    - "pattern_export"
    - "api_access"

                                For Contributors

                                1. Code Review Requirements

                              7. All PRs require security review for changes to:
                              9. Authentication/authorization logic
                              11. Database operations
                              13. File system operations
                              15. Network communications

                              17. External API integrations

                              18. 2. Security Testing

                              19. # Run security tests before committing
npm run test:security

# Check for common vulnerabilities
npm audit

# Static analysis
npm run lint:security

                                3. Secure Coding Guidelines

                              20. Input Validation: Validate all user inputs and external data
                              22. Output Encoding: Encode output to prevent injection attacks
                              24. Parameterized Queries: Use parameterized queries for database operations
                              26. Least Privilege: Grant minimum necessary permissions
                              28. Error Handling: Never expose sensitive information in error messages

                              30. Dependency Management: Keep dependencies updated and audited

                              31. 4. Pre-commit Hooks

                              32. # Install security pre-commit hooks
npm run setup:security-hooks

# Hooks will automatically:
# - Run npm audit
# - Check for hardcoded secrets
# - Validate file permissions
# - Run security linters

                                Known Security Considerations

                                1. AI Model API Keys

                                Risk: AI model API keys (OpenAI, Anthropic, etc.) grant access to paid services.

                                Mitigation:

                              33. Store keys in environment variables only
                              35. Never commit keys to version control
                              37. Use .gitignore to exclude .env files
                              39. Rotate keys regularly
                              41. Monitor API usage for anomalies

                              43. Set spending limits in provider dashboards

                              44. 2. Test Data

                              45. Risk: Test data generation might create sensitive-looking data.

                              46. Mitigation:

                              48. Generated test data is synthetic and not real
                              50. Configure data generation to avoid realistic PII
                              52. Use faker libraries with non-sensitive seeds

                              54. Document that test data is for testing only

                              55. 3. Database Storage

                              56. Risk: SQLite database stores agent learning data and patterns.

                              57. Mitigation:

                              59. Database is stored locally (not transmitted)
                              61. Enable encryption for sensitive environments
                              63. Set appropriate file permissions (600)
                              65. Exclude from backups to untrusted locations

                              67. Regular cleanup of old data

                              68. 4. MCP Server

                              69. Risk: MCP server exposes API endpoints for agent coordination.

                              70. Mitigation:

                              72. Bind to localhost (127.0.0.1) by default
                              74. Enable API key authentication in production
                              76. Use rate limiting to prevent abuse
                              78. Deploy behind reverse proxy in production

                              80. Enable HTTPS for remote access

                              81. 5. Pattern Sharing

                              82. Risk: Exported patterns might contain project-specific information.

                              83. Mitigation:

                              85. Review patterns before sharing externally
                              87. Patterns contain code structure, not secrets
                              89. Option to sanitize patterns before export

                              91. Document pattern privacy in sharing features

                              92. 6. Log Files

                              93. Risk: Logs might contain sensitive operational data.

                              94. Mitigation:

                              96. Configure log levels appropriately
                              98. Exclude sensitive data from logs
                              100. Rotate and archive logs regularly

                              102. Secure log file permissions (600)

                              104. Use structured logging for easier filtering

                                105. Compliance

                                OWASP Compliance

                              105. Current Status: 90%+ compliance (improved from 70% in v1.1.0)
                              107. OWASP Top 10: Addressed all critical categories
                              109. Testing: Regular OWASP ZAP scans

                              111. Documentation: Security controls documented

                              112. Data Protection

                              114. GDPR: Test data generator supports GDPR-compliant synthetic data
                              116. Data Residency: All data stored locally by default
                              118. Data Portability: Export/import functionality for all data

                              120. Right to Deletion: Easy data cleanup and removal

                              121. Open Source Security

                              123. SPDX License: MIT License (SPDX-License-Identifier: MIT)
                              125. CycloneDX SBOM: Software Bill of Materials available

                              127. Vulnerability Disclosure: Coordinated disclosure policy

                              129. Security Champions: Designated security maintainers

                                130. Security Updates

                                Staying Informed

                              130. GitHub Security Advisories: Watch this repository for security advisories
                              132. Release Notes: Check CHANGELOG.md for security fixes
                              134. Email Updates: Subscribe to [email protected] for critical alerts

                              136. Twitter: Follow @AgenticQE for announcements

                              137. Update Notifications

                              138. # Check for security updates
npm outdated agentic-qe

# View security advisories
npm audit

# Update with security fixes
npm update agentic-qe

                                Security Contacts

                              139. Security Team: [email protected]
                              141. General Support: [email protected]

                              143. Maintainers: See CODEOWNERS file

                              144. PGP Key

                              145. For encrypted communications, use our PGP key:

                              146. Fingerprint: [To be added]
Key ID: [To be added]
Download: https://keys.openpgp.org/[email protected]

                                Acknowledgments

                                We appreciate the security research community's efforts. Security researchers who responsibly disclose vulnerabilities will be:

                              147. Credited in release notes (unless anonymity is preferred)

                              149. Listed in our SECURITY-HALL-OF-FAME.md (coming soon)

                              151. Eligible for recognition in our documentation

                              152. Thank you for helping keep Agentic QE secure!

                                153. Additional Resources

                              153. Contributing Guide - Contribution guidelines including security
                              155. Documentation - Complete documentation

                              157. OWASP Top 10 - OWASP security standards

                              159. npm Security Best Practices - npm security

                                160. Last Updated: October 22, 2025 Version: 1.2.0

There aren’t any published security advisories