Security

Tasuku assumes the server, worker, Postgres, and selected sandbox infrastructure are operator-controlled. Agent model output and repository content are untrusted inputs.

Webhooks and GitHub

• Verify every webhook signature before persistence.
• Deduplicate by GitHub delivery ID.
• Use the App installation for repository scope and publication identity.
• Keep the private key, client secret, and webhook secret encrypted in Postgres.

Agent isolation

• Do not supply GitHub credentials to the agent process.
• Clone at recorded commits and mount secondary repositories read-only.
• Validate bounded artifact paths before creating Git objects.
• Apply CPU, memory, process, filesystem, and network controls appropriate to the sandbox provider.

The bundled Docker container drops capabilities, sets no-new-privileges, uses a read-only root filesystem, and uses temporary writable filesystems. These controls reduce impact; they do not make a shared Docker socket safe for untrusted tenants.

Secret handling

User-managed secrets and GitHub App credentials depend on TASUKU_MASTER_KEY. Plaintext is not returned by read APIs. Structured logging excludes secret plaintext and webhook bodies.

Keep the master key outside the database backup and restore both together. The current implementation does not expose an operator-safe multi-key rotation sequence.

Access control

Authorization is organization-scoped and capability-based through USER, ADMIN, and SUPER_USER. Disabling a user revokes active sessions. Transactional protection prevents removal of the last active super user.

Signup uses exact verified-email domain matching. Do not treat example.com as authorizing sub.example.com; list both explicitly when intended.

External systems

HTTPS MCP servers, Daytona, Lambda, agent providers, and GitHub are separate trust domains. Evaluate how each stores prompts, repository content, logs, and credentials.