Security rulesComing soon

Plugins can reach outside systems and real people, so the rules below are enforced by CoderHelm itself. A plugin's instructions can't relax them, and neither can a model that has been tricked by text it read.

1. No plugin code runs. A plugin is text plus declared tools. Scripts in a plugin repo are never executed.
2. Only declared tools exist. A tool missing from plugin.yaml can't be called, by any agent, in any run.
3. Every tool has a risk level, shown on the plugin's page, and the team sees it before installing.
4. Consequential actions need a person. Publish, send and post run only after an approval of the exact version of the draft, from someone other than the requester. A stop is permanent.
5. Each team caps autonomy. The team chooses whether plugins only read, or may also save drafts, without a person.
6. Installing grants nothing. Connections are made separately, shared or per person.
7. Secrets never reach the model. Secrets, connection tokens and sensitive settings are sealed with KMS, added to requests after the model chose the call, and never sent back to the dashboard.
8. Widening needs approval. New or wider tools, triggers, connections or outputs wait for an admin.
9. Installs are pinned to exact content, with a second admin's approval when the team has two.
10. Everything is metered and counted against the plugin's and the team's token limits.
11. Everything is recorded. The Audit log page shows every plugin step in one place: who or what started it, which version ran, each tool and how much it could do, who approved, and what happened.

RolesCopy Anchor Link

Reporting a problemCopy Anchor Link

If you find a way around one of these rules, email security@coderhelm.com rather than opening a public issue.