# Security rules

Source: https://docs.coderhelm.com/plugins/security

The rules every plugin runs under, enforced in code rather than by the plugin's instructions.

> Coming soon: this page describes work that is not on main yet.

<Callout type="info" title="Coming soon">Plugins are being built and switched on team by team; they are not on main yet. This page follows the work in progress and will be updated when plugins ship.</Callout>

Plugins can reach outside systems and real people, so the rules below are enforced by CoderHelm itself. A plugin's instructions can't relax them, and neither can a model that has been tricked by text it read.

1. **No plugin code runs.** A plugin is text plus declared tools. Scripts in a plugin repo are never executed.
2. **Only declared tools exist.** A tool missing from `plugin.yaml` can't be called, by any agent, in any run.
3. **Every tool has a risk level**, shown on the plugin's page, and the team sees it before installing.
4. **Consequential actions need a person.** Publish, send and post run only after an approval of the exact version of the draft, from someone other than the requester. A stop is permanent.
5. **Each team caps autonomy.** The team chooses whether plugins only read, or may also save drafts, without a person.
6. **Installing grants nothing.** Connections are made separately, shared or per person.
7. **Secrets never reach the model.** Secrets, connection tokens and sensitive settings are sealed with KMS, added to requests after the model chose the call, and never sent back to the dashboard.
8. **Widening needs approval.** New or wider tools, triggers, connections or outputs wait for an admin.
9. **Installs are pinned** to exact content, with a second admin's approval when the team has two.
10. **Everything is metered** and counted against the plugin's and the team's token limits.
11. **Everything is recorded.** The **Audit log** page shows every plugin step in one place: who or what started it, which version ran, each tool and how much it could do, who approved, and what happened.

## Roles [#roles]

| Capability | Lowest role |
| --- | --- |
| `plugins.install` | Admin |
| `plugins.run` | Member |
| Approving a plugin's drafts | The people listed on the plugin's page (admins when nobody is listed) |

## Reporting a problem [#reporting-a-problem]

If you find a way around one of these rules, email security@coderhelm.com rather than opening a public issue.