Files

T

Hop 011f6fa102 Reconcile no-Actions local release workflow with accepted Hop implementation

Hop-State: A_06FN5GEZTNDD5V7A7PXHBR0
Hop-Proposal: R_06FN5GDDA8WVH1V6JW0FBY0
Hop-Task: T_06FN3MBF98GWD4NA5PA1RWG
Hop-Attempt: AT_06FN5FPYNDP5C49S0G52NQG

2026-07-11 12:57:45 -07:00

2.2 KiB

Raw Blame History

Security and privacy

Local data

Hop stores state in the project under .hop/. Prompt text, source trees, commands, and check output are local unless the project or its filesystem is copied elsewhere. SQLite data is not encrypted at rest.

.hop/ is excluded through .git/info/exclude, so ordinary Git operations do not publish it. Initialization refuses to hide a .hop directory that the project already tracks.

Credential redaction

Before persistence, Hop redacts high-confidence provider keys, contextual tokens/passwords, private keys, authorization headers, and credential-bearing URLs. The same sanitizer is applied to proposal summaries and recorded check commands/output.

Detection is defense in depth, not a guarantee. Use environment variables or a secret manager. Rotate any real credential pasted into any agent prompt even when Hop reports a redaction.

Installer and release integrity

Packaged installers download checksums.txt from the same published Gitea Release and verify the selected archive before extraction. Gitea Releases are created as drafts, after race tests, vetting, and cross-platform builds, then must be reviewed before publication.

For stronger provenance before general availability, the release owner should sign checksums.txt with an offline-controlled release key and publish the public key independently. Checksum signing is listed as a launch gate in the release checklist.

Release-machine trust

Release builds execute on a maintainer machine, not on the Gitea server. Use a trusted, patched machine; keep the release token out of shell history and source files; scope it to the Hop repository; export it only for the publish command; and unset it immediately afterward. Releases upload as drafts for review.

Filesystem safety

Hop does not use reset --hard, move the active branch, or write the user's real Git index. Visible-root synchronization fails closed when files, ignored destinations, or staged state could be overwritten.

Reporting a vulnerability

Before the public security contact is configured, disclose vulnerabilities privately to the repository owner rather than opening a public issue. Add a SECURITY.md with the final contact before the first public release.

2.2 KiB Raw Blame History