Security

Security

Scholion is built for one machine or a trusted network. Read this before exposing anything.

• Auth token. Set AV_TOKEN to require Authorization: Bearer <token> on every route but /healthz and /ui (/ui is a static page with no data in it; it asks for the token once per browser tab). The token is compared in constant time. The av CLI and its hooks send $AV_TOKEN. Agent config files written by av init --for … name the variable, never the token itself.
• Without a token the daemon is open. That is why the compose file publishes the daemon, Postgres and Qdrant on 127.0.0.1 only. Do not expose these ports either way.
• Agent names are self-asserted (--agent, AV_AGENT, X-Av-Agent). "The reviewer is not the owner", "only the owner hands off" and claim fencing prevent accidents between cooperating agents, not impersonation.
• The daemon never runs repository commands. Validations are attestations reported by clients. av runner runs the post-merge check on your machine and refuses to start without --trust, because the command comes from the daemon's database.
• Inputs. Repository names are restricted to a single path component, av repo add only accepts an existing local directory, and backup remotes that look like git options are refused.
• Keys. The daemon holds no keys for the agents' own models. Its only secrets are an optional embedding API key and AV_TOKEN.
• The Postgres credentials in the compose file are for development only.

Reporting a vulnerability

Please report security problems privately, through a GitHub security advisory, rather than in a public issue.