Email security@lacausecrypto.com with:

• Description and reproduction steps
• Impact assessment
• Suggested fix (if any)

Response targets: acknowledgment within 48 hours, fix within 7 days for critical issues.

• API key authentication via Authorization: Bearer <key> header.
• In production (NODE_ENV=production), the server refuses to start without OCC_API_KEY.
• In development (no NODE_ENV), auth is optional (warning logged if unset).
• Query parameter auth (?api_key=) has been removed — keys leak in server logs, browser history, and proxy caches.
• API key comparison uses crypto.timingSafeEqual to prevent timing attacks.

• LLM provider API keys are encrypted at rest with AES-256-GCM (scrypt key derivation).
• In production, OCC_ENCRYPTION_KEY is required (server exits without it).
• In development without a key, an ephemeral per-process key is generated — stored keys won't survive restarts.
• No hardcoded default encryption key exists in the codebase.

If the server detects REST_HOST=0.0.0.0 without OCC_API_KEY, it prints a prominent warning banner to stderr.

Rate limiting keys use the API key (first 8 chars) when present, falling back to IP address.

Some pre-tools have elevated risk. Review chain YAML carefully before running untrusted chains.

• sanitizeName() rejects names with .., /, \, null bytes, and non-alphanumeric characters.
• read_file / write_file resolve symlinks via fs.realpathSync() and verify the resolved path is within WORKSPACE_DIR or /tmp.
• write_file validates the path before creating parent directories (prevents TOCTOU race).

• All chain definitions validated with Zod schemas at load time.
• REST request bodies validated before processing.
• All child processes use execFileSync (array args), never exec with string concatenation.
• No eval(), new Function(), or dynamic code execution anywhere in the codebase.

• Error messages sent to clients are sanitized: internal file paths and stack traces are stripped.
• Full error details are logged server-side only.
• The global error handler returns generic "Internal server error" for unhandled exceptions.

All responses include:

• X-Content-Type-Options: nosniff
• X-Frame-Options: DENY
• Referrer-Policy: no-referrer
• X-Powered-By header removed

The React frontend includes a strict Content Security Policy:

default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';
img-src 'self' https: data:; object-src 'none'; frame-ancestors 'none'

• CLAUDE_CLI / CLAUDE_BIN environment variables are validated: only "claude" (default) or absolute paths are accepted.
• Relative paths, paths containing .., and paths with shell metacharacters are rejected (falls back to "claude").

• Non-root user (occ:occ)
• security_opt: no-new-privileges:true
• cap_drop: ALL
• read_only: true filesystem
• tmpfs: /tmp:size=100M
• Health check via /health endpoint
• .dockerignore excludes .env, .git, *.db, node_modules

• Set NODE_ENV=production
• Set OCC_API_KEY (server exits without it)
• Set OCC_ENCRYPTION_KEY (unique per installation)
• Set REST_HOST=0.0.0.0 only behind reverse proxy with TLS
• Set CORS_ORIGIN to your exact domain
• Set LOG_LEVEL=info (not debug)
• Review all chain YAML files for bash and db_query pre-tools
• Run npm audit and check for vulnerabilities
• Set up firewall to block direct access to port 4242
• Configure reverse proxy (nginx/Caddy) with TLS certificates
• Set EXECUTION_MAX_AGE_DAYS to auto-purge old data

• Single API key — no per-user or per-role access control.
• No audit log — API actions are logged but not in a structured audit trail.
• Bash pre-tool — chains with bash can execute arbitrary commands. Power feature, requires trust in chain authors.
• BLOB sessions — autonomous mode can trigger executions without user approval. Configure budget limits.
• No request signing — API key is the only auth mechanism. Consider mTLS at proxy level for high-security environments.