Security Model & Controls

Security Guide

Layered controls, key components, operational practices, and hardening checklist.

Security Model

Request Validation

All inputs validated against strict schemas before execution.

Governance Enforcement

Strict, adaptive, and autonomous modes control agent permissions.

Safety Gates

High-risk actions pass through safety gates with execution previews.

Policy-Based Blocking

Policy violations are blocked, logged, and returned with remediation.

Authentication & Accounts

POST /api/auth/login, POST /api/auth/register, GET /api/auth/session proxy to SKIA_BACKEND_URL for IDE and API clients.

Marketing HTML omits web sign-in/register CTAs; users authenticate in the SKIA Forge IDE.

Key Security Components

SecurityAnalysisService — scan and save-time checks on code and agent output

Governance decision engine — strict / adaptive / autonomous control with audit trail

Route and action-level safety modules — per-surface constraints that cannot be bypassed

Operational Security Practices

Keep secrets out of repositories and logs — use your hosting provider's environment variables

Validate all external integration responses — never trust third-party data without assertion

Treat policy blocks as first-class security events — every block is logged and reviewable

Record and monitor remediation outcomes — fixes without validation are incomplete

Hardening Checklist

Run lint, typecheck, and tests before every release

Keep all dependencies current

Validate integration probe endpoints regularly

Review audit trails after major orchestration runs

Rotate JWT_SECRET and API keys on schedule

Never commit secrets — use environment injection