fix(control): contain image file references

SECURITY.md

@@ -0,0 +1,137 @@
+# Security Policy
+
+## Supported Versions
+
+Reasonix security fixes are prioritized for the currently developed Go rewrite
+and the current 1.x release line.
+
+| Version or branch | Security support |
+| --- | --- |
+| `main-v2` / 1.x releases | Supported |
+| `v1` / 0.x legacy branch | Critical fixes only, where practical |
+| Older releases, forks, or modified builds | Not covered unless the issue is reproducible upstream |
+
+If you are unsure whether a version is affected, report against the newest
+released 1.x version and include the exact version or commit you tested.
+
+## Reporting a Vulnerability
+
+Please report security issues privately. Do not open a public issue with exploit
+details, secrets, crash dumps, or proof-of-concept payloads.
+
+Preferred reporting path:
+
+1. Use GitHub private vulnerability reporting for this repository, if available.
+2. If private reporting is not available to you, open a minimal public issue
+   asking for a private maintainer contact path. Do not include exploit details
+   in that issue.
+
+Please include:
+
+- Affected Reasonix version, commit, operating system, and installation method.
+- The feature or surface involved, such as CLI, desktop app, HTTP `serve`, bot
+  gateway, MCP plugin, built-in tool, updater, or configuration loading.
+- Clear reproduction steps using dummy credentials and non-sensitive files.
+- The expected impact, such as secret disclosure, arbitrary file access,
+  command execution, sandbox escape, authentication bypass, or supply-chain risk.
+- Any relevant logs with API keys, tokens, local paths, and personal data
+  redacted.
+
+Do not send real provider API keys, bot credentials, OAuth tokens, private
+workspace files, or third-party user data.
+
+## Security Boundaries
+
+Reasonix is a local coding agent. Many features intentionally operate on the
+user's local machine and workspace, including file reads, file writes, shell
+commands, MCP plugins, language servers, bot sessions, and model-provider
+requests. A finding is security-relevant when it crosses a supported boundary or
+bypasses an explicit guard.
+
+Supported boundaries include:
+
+- Workspace confinement for file operations that are documented or implemented
+  as workspace-scoped.
+- Permission checks for tool calls, shell commands, file writes, and approvals.
+- Sandbox behavior for built-in shell execution where the platform supports it.
+- Secret handling for provider keys, bot credentials, OAuth tokens, plugin
+  headers, and credential-store fallback files.
+- HTTP `serve` protections for the unauthenticated local server, including
+  localhost binding assumptions, JSON-only state-changing requests, and CORS
+  restrictions.
+- Desktop and bot session isolation, including per-workspace session metadata
+  and configured bot allowlists.
+- Updater, install, and release verification paths.
+
+The following are normally treated as trusted local/operator-controlled inputs
+unless another bug lets an untrusted actor supply them:
+
+- CLI arguments and text typed directly by the local user.
+- Project configuration files intentionally loaded from the current workspace.
+- Explicit `@path` references supplied by the local user to attach local files.
+- MCP servers, language servers, hooks, and slash commands installed or enabled
+  by the local user.
+- Provider base URLs and model names configured by the local user.
+
+The following can be security issues when reachable by an untrusted actor or
+when they bypass the intended boundary:
+
+- Reading or writing files outside the configured workspace without explicit
+  local-user intent.
+- Following symlinks or path traversal to escape workspace confinement.
+- Running shell commands or external tools without the required permission gate.
+- Leaking credentials, environment variables, prompt history, local files, or bot
+  messages to logs, model providers, MCP servers, crash reports, or telemetry.
+- Allowing a website to drive the local HTTP server through CSRF, CORS, or
+  content-type bypasses.
+- Letting a bot user outside the configured allowlist submit prompts, approve
+  tools, or access a project workspace.
+- Trusting unverified update artifacts, plugin definitions, or downloaded
+  binaries.
+
+## `@` File References
+
+Reasonix supports `@path` references so users can include local files and images
+in a prompt. This is intentional local functionality, but implementations must
+preserve these invariants:
+
+- In workspace-scoped sessions, relative and absolute paths must resolve under
+  the active workspace root before file content is read or attached.
+- Path traversal such as `..` must not escape the workspace root.
+- Symlinks must not be usable to bypass the intended workspace boundary.
+- Unscoped local CLI compatibility must not be exposed to remote, bot, or
+  browser-controlled inputs unless an equivalent workspace boundary is applied.
+- File content should be size-limited and binary content should not be dumped as
+  prompt text.
+
+Static analysis alerts about path expressions should be triaged against these
+rules: user-controlled path data is expected, but the access must either stay
+inside the configured workspace or be clearly limited to trusted local CLI use.
+
+## Out of Scope
+
+The following reports are usually out of scope unless they demonstrate a bypass
+of one of the boundaries above:
+
+- A local user intentionally asks Reasonix to read, edit, or send their own
+  files to a configured model provider.
+- A local user installs or enables a malicious MCP server, hook, slash command,
+  language server, or shell command and then grants it permission.
+- A configured model provider, proxy, or MCP server receives data the user
+  intentionally sent to it.
+- Denial-of-service issues that only affect the local user's own session and do
+  not corrupt files, leak secrets, or bypass permissions.
+- Issues requiring administrator/root access on the user's machine before
+  interacting with Reasonix.
+- Vulnerabilities in third-party services, models, proxies, or plugins that are
+  not caused by Reasonix behavior.
+
+## Coordinated Disclosure
+
+This is a community-maintained project. Maintainers will make a best-effort
+assessment, ask follow-up questions when needed, and coordinate fixes before
+public disclosure for confirmed vulnerabilities.
+
+Please give maintainers reasonable time to investigate and release a fix before
+publishing exploit details. If you plan to disclose on a timeline, include that
+timeline in your initial report.