ForgeOS v1.20.1

Security

Trust comes from visible limits

ForgeOS earns trust by making its limits visible. This page states what the checks enforce, what they do not guarantee, and where to report a vulnerability without making it public.

Cited release v1.20.1

The boundary, stated plainly

The hooks and validation checks are a safety net against accidents, not a security boundary. They reduce preventable mistakes during governed delivery; they do not replace review, least privilege, or a real threat model.

What is mechanically enforced

These checks are mechanical controls for governed delivery. They catch known unsafe patterns and unauthorized writes before a task is treated as complete.

Destructive command refusal

The command guard refuses known destructive shapes before they run and prints the reason.

Governed writes

Discovery and governance guards refuse writes outside authorized paths; implementation windows fail closed when missing, empty, malformed, or too broad.

Secret-shaped content checks

The secret scanner blocks credential-shaped strings before a change is called complete.

Evidence before completion

Validation refuses a completion claim unless the relevant checks were executed and observed.

What is not guaranteed

  • The hooks protect only the tool surface that runs them; work outside that surface is outside their reach.
  • The rules live in repository files, so repository write access can alter those rules.
  • Pattern checks catch known shapes; new unsafe shapes need new checks.
  • The build machine and repository host remain part of the trust surface.

Operational posture

  • No telemetry is collected or transmitted by ForgeOS tooling.
  • No script under scripts/ fetches, posts, or resolves network resources.
  • No installer asks readers to pipe remote content into a shell.
  • Sync operations announce every file before they write and run as dry runs unless apply is requested.

Report privately

Report vulnerabilities through the repository security advisory route, not as a public issue. Include what you found, the file or script involved, steps to reproduce, and the impact. Do not include a real secret value.

Open a private advisoryRead the security policy