feat: add Security Analyzer functionality#3058
Conversation
…e based on defined risk
xingyaoww
left a comment
xingyaoww
left a comment
There was a problem hiding this comment.
Backend LGTM! If frontend also look good to folks, i'd be have to approve it.
| # Security | ||
|
|
||
| Given the impressive capabilities of OpenDevin and similar coding agents, ensuring robust security measures is essential to prevent unintended actions or security breaches. The SecurityAnalyzer framework provides a structured approach to monitor and analyze agent actions for potential security risks. | ||
|
|
There was a problem hiding this comment.
Could you add a section here as a quick start to show people how to enable this feature? e.g., on the UI and on the backend?
There was a problem hiding this comment.
sure, added it in the latest commit:
| To enable this feature: | |
| * From the web interface | |
| * Open Configuration (by clicking the gear icon in the bottom right) | |
| * Select a Security Analyzer from the dropdown | |
| * Save settings | |
| * (to disable) repeat the same steps, but click the X in the Security Analyzer dropdown | |
| * From config.toml | |
| ```toml | |
| [security] | |
| # Enable confirmation mode | |
| confirmation_mode = true | |
| # The security analyzer to use | |
| security_analyzer = "your-security-analyzer" | |
| ``` | |
| (to disable) remove the lines from config.toml |
|
Hey @adrgs, I'd be happy to merge it if you could resolve the conflict (i help did it in this PR invariantlabs-ai#1) |
Merge main and resolve conflict
thanks for the help @xingyaoww ! should be up to date with main now |
|
Hey @xingyaoww , could you make the final call on this and we can get it merged in? This is exciting! |
|
@adrgs sorry for the late response! Could you resolve the one last merge conflict: invariantlabs-ai#2 |
Fix merge conflict
|
@xingyaoww added, thanks! |
5 participants
What is the problem that this fixes or functionality that this introduces? Does it fix any open issues?
This PR introduces the possibility of having a defined security analyzer watch over OpenDevin's actions and watch accordingly. It's integrated by default with confirmation mode, which analyzers can make use of by auto-approving actions deemed safe.
We have also implemented such an analyzer, using invariant
Give a summary of what the PR does, explaining any non-trivial design decisions
Backend
/api/security/{path:path}API route, for the analyzers to be able to interact with the user without having to modify the core code for each/api/options/security-analyzersendpoint, which lists the agentsFrontend
frontend/src/components/modals/security, a place where the modules can create their own modalsOther references
Video of how the changes look like:
https://www.youtube.com/watch?v=brH7CUGyzmI