Security
How to report a vulnerability, how Ephyra protects sessions, secrets and approvals, and its known limits.
Revised · Review copy
Prepared for review, not yet effective. The operator is Keith Abiola Noel, a sole proprietor in Québec, Canada. A public business mailing address, legal review and a French edition must be completed before adoption.
Reporting a vulnerability
Email ephyra@notorganic.info with what you found, how to reproduce it, the version or commit you tested, and what an attacker could do with it. Please don’t include passwords, private keys or personal information you don’t need. We will acknowledge your report, keep you updated while we fix it, and credit you if you want credit. There is no bug bounty yet.
Test against a deployment you run yourself. Do not test deployments other people operate, the Not Organic service, or other people’s repositories. Do not access, change or keep other people’s data, and do not degrade the service for anyone. If you follow these rules and report in good faith, we will not pursue or support legal action against you for your research.
Not Organic, Amp, Radicle, Tangled and our other providers run their own disclosure programs. Report issues in their services to them.
Machine-readable contact: /.well-known/security.txt.
How Ephyra protects what it touches
- Untrusted content stays data. Signal text, logs, stack traces, forge comments and study answers are wrapped as untrusted blocks in prompts. They are never placed in system or instruction text, and they never grant a capability.
- Approvals are bound. Each checkpoint approval is bound to the quest revision and head it was shown, and the landing approval is also bound to the proof digest. If the quest has changed since, the approval is refused. Only people on the deployment’s approver list can approve, and every approval goes into the quest journal and the audit log.
- Landings carry their proof. Landed commits carry
Ephyra-TrailandEphyra-Prooftrailers, and proof bundles are pinned by digest. A watch window can roll a landing back. Evidence that was not gathered is reported as missing, never as passed. - Writes happen once. Every external write carries an operation key. A write whose outcome is unclear goes to a person for reconciliation instead of being blindly retried.
- Sign-in is bound to the server. Sign-in uses Not Organic with PKCE and DPoP-bound tokens; the DPoP key is held by the server. Refresh tokens are encrypted with AES-GCM before storage and rotated with compare-and-swap. Terminal sign-in needs a browser approval with a matching code, and the CLI keeps its credentials in a file only your user account can read.
- The database refuses strangers. Every Convex function checks a shared deployment secret with a constant-time comparison, and refuses the call when the secret is missing or wrong.
- Secrets stay out of the record. Secrets come from the environment or a credential reference. They are never logged, committed, written to journals, or sent to models.
Known limits
- Ephyra is pre-alpha. It has had no third-party security audit, and it holds no SOC 2, ISO 27001 or other certification.
- The local runner is for trusted repositories only. It is not a security sandbox and does not limit network or resources. The Railway and Not Organic runners are not yet verified against live services.
- Models can be manipulated by content they read. Checkpoints, proof and the approver list exist because a model’s judgement is not a security control.