Skip to content

Security: darklordVirtual/REMORA

Security

SECURITY.md

Security Policy

Supported Versions

REMORA is a research prototype. The following versions receive security attention:

Version Status
0.6.x (current main) Security issues accepted
< 0.6 No active maintenance

Reporting a Vulnerability

Please do not open a public GitHub issue for security vulnerabilities.

Report security issues to: support@luftfiber.no

Include in your report:

  • Description of the vulnerability
  • Steps to reproduce
  • Affected component (Python core / Cloudflare Worker / MCP server)
  • Potential impact

You will receive acknowledgement within 72 hours and a fix timeline within 14 days for P0 issues.

Scope

In-scope for security reports:

  • Authentication bypasses in Cloudflare Workers (workers/)
  • Prompt injection vulnerabilities in the cascade pipeline
  • Tool-call policy bypasses in remora/agent_hook.py
  • Sensitive data exposure in audit logs or MCP responses
  • Dependency vulnerabilities with CVSS ≥ 7.0

Out of scope:

  • Theoretical attacks without a proof of concept
  • Issues in demo-mode configurations explicitly marked insecure
  • Rate limiting / DoS on the public demo workers

Known Security Properties

Fail-closed authentication (as of v0.6.1)

Both Cloudflare Workers fail closed when secrets are not configured:

  • rag-oracle: ORACLE_SECRET unset → all requests return 401
  • agent-control: CONTROL_SECRET unset → all write requests return 503

Sensitive GET endpoints require auth

GET /audit and GET /test-bindings on the agent-control worker require Authorization: Bearer <CONTROL_SECRET>.

Public status endpoint sanitised

GET /status does not expose upstream worker URLs.

Deployment Security Checklist

See docs/security/pre-deployment-review.md for the full pre-deployment checklist.

Known Gaps (Honest Failure Surface)

Gap Risk Level Mitigation
No CORS allowlist Medium Demo-only; restrict origins before browser-facing production deploy
No rate limiting on workers Medium Add Cloudflare Rate Limiting rules before production
/query on rag-oracle is unauthenticated Low–Medium Acceptable if KB is non-sensitive; add auth otherwise
Audit log UPDATE allowed Low WORM log recommended for regulated deployments
No mTLS between workers Low Add Cloudflare Zero Trust mTLS if required by compliance

This file is updated when new security properties are established or new gaps are identified.

There aren't any published security advisories