Hop
853acec229
Hop-State: A_06FN6KM758JV6S44F6CA6W0 Hop-Proposal: R_06FN6KJWAY5XWVMCVQHCXKR Hop-Task: T_06FN6GZKFMRV2HP5N7XMNSR Hop-Attempt: AT_06FN6GZKFP22ZCFRXGB7V00
61 lines
2.7 KiB
Markdown
61 lines
2.7 KiB
Markdown
# Security and privacy
|
|
|
|
## Local data
|
|
|
|
Hop stores state in the project under `.hop/`. Prompt text, source trees,
|
|
commands, and check output are local unless the project or its filesystem is
|
|
copied elsewhere. SQLite data is not encrypted at rest.
|
|
|
|
`.hop/` is excluded through `.git/info/exclude`, so ordinary Git operations do
|
|
not publish it. Initialization refuses to hide a `.hop` directory that the
|
|
project already tracks.
|
|
|
|
## Credential redaction
|
|
|
|
Before persistence, Hop redacts high-confidence provider keys, contextual
|
|
tokens/passwords, private keys, authorization headers, and credential-bearing
|
|
URLs. The same sanitizer is applied to proposal summaries and recorded check
|
|
commands/output.
|
|
|
|
Detection is defense in depth, not a guarantee. Use environment variables or a
|
|
secret manager. Rotate any real credential pasted into any agent prompt even
|
|
when Hop reports a redaction.
|
|
|
|
## Installer and release integrity
|
|
|
|
Packaged installers download `checksums.txt` from the same published Gitea
|
|
Release and verify the selected archive before extraction. Gitea Releases are
|
|
created as drafts, after race tests, vetting, and cross-platform builds, then
|
|
must be reviewed before publication.
|
|
|
|
For stronger provenance before general availability, the release owner should
|
|
sign `checksums.txt` with an offline-controlled release key and publish the
|
|
public key independently. Checksum signing is listed as a launch gate in the
|
|
[release checklist](Release-Checklist).
|
|
|
|
## Release-machine trust
|
|
|
|
Release builds execute on a maintainer machine, not on the Gitea server. Use a
|
|
trusted, patched machine; keep the release token out of shell history and source
|
|
files; scope it to the Hop repository; export it only for the publish command;
|
|
and unset it immediately afterward. Releases upload as drafts for review. The
|
|
token must be provisioned by the user outside the agent session: Hop and its
|
|
agents never create, rotate, list, or revoke provider account tokens.
|
|
|
|
## Filesystem safety
|
|
|
|
Hop does not use `reset --hard`, move the active branch, or write the user's
|
|
real Git index. Visible-root synchronization fails closed when files, ignored
|
|
destinations, or staged state could be overwritten.
|
|
|
|
Automatic push delegates authentication to the user's existing Git transport
|
|
and credential configuration. Hop does not store remote passwords, SSH private
|
|
keys, or access tokens. It disables terminal credential prompting in the
|
|
background push path and redacts detected credentials from returned errors.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Before the public security contact is configured, disclose vulnerabilities
|
|
privately to the repository owner rather than opening a public issue. Add a
|
|
`SECURITY.md` with the final contact before the first public release.
|