Security

This page separates source-observed mechanisms from production security targets. Repository review does not establish the deployed TLS, headers, tenant isolation, encryption, backups, operator access, retention jobs, deletion completion, or incident operating history. Hosted API mode processes prompts, responses, and provider authorization and should be treated as sensitive.

Effective date: July 10, 2026. Security contact: rishabh@costlayers.com.

Source-Observed Controls and Targets

• TLS/HSTS target: public and API endpoints should use HTTPS and HSTS. Deployment configuration evidence is not attached.
• Tenant-isolation target: source has keyed paths and scoped queries; complete automated cross-tenant tests remain required.
• Rate-limit and revocation target: mechanisms exist in source; distributed enforcement and production evidence are missing.
• Local secret handling, partial: the CLI requests out-of-repo storage and restrictive modes where supported; platform enforcement is unverified.
• Local artifact ignore, partial: the CLI attempts to update .gitignore and warns on failure. Users must verify it.
• Metadata-only reporting target: default hosted reporting should avoid raw source, paths, prompts, and responses. Deployment canary evidence is required.
• Security-header target: CSP, frame, content-type, referrer, cache, HSTS, and noindex policies require deployed response captures.
• Proof integrity boundary: hashes and labels are evidence references, not signatures, independent assurance, or proof of current behavior.

Data Flow Summary

Hosted API Mode Boundary

Hosted API mode is not local-only scanning. It routes provider-bound requests, responses, and authorization through the gateway. Source is designed to retain metering metadata and hashes and to persist response bodies only after cache opt-in. That non-persistence boundary is not deployment-verified, and provider-side logs remain governed by your provider account.

Response Cache Guardrails

Source review shows an explicit confirmation command, cache generation binding, a 30-day source default, and keyed disable/purge paths. The production target is that disable/delete prevents new body persistence and removes controlled primary rows. Concurrency, restart, fallback journal, backup, and operator-access tests are still open.

API Key Handling

Use dedicated provider keys through environment variables or headers, never committed files. Source intends not to persist provider authorization and hides full dashboard URLs by default, but secret canaries, logs, redirects, SSRF boundaries, and platform permissions still require verification. Treat CostLayers keys and dashboard URLs as bearer credentials.

Local Artifacts

Source writes audit, proof, quality, cache, and report files under .agentspend/ and attempts to add a root ignore rule. Keep the directory out of public repositories and tickets. Local cleanup is partial: run costlayers privacy delete-local, inspect its report, and complete any manual cleanup it identifies.

Retention and Deletion Targets

• Account/access and usage metadata: target no more than 180 days after last activity; no complete age-based enforcement evidence.
• Raw API traffic: request-transient target unless response cache is enabled; deployment canary evidence missing.
• Opt-in response bodies: 30-day maximum target; source pruning exists, deployment and backup tests missing.
• Security logs: 90-day target. Support/security correspondence: 24-month target subject to documented exceptions. Vendor configuration is unverified.
• Hosted primary deletion: immediate revocation and controlled-row deletion target for reachable API requests; end-to-end receipts, retries, races, and operating history missing.
• Manual deletion: 2-business-day acknowledgement and 30-day primary-store completion targets. Backup expiry within 30 days is also a target; backup inventory and restore evidence are unknown.

Customer Responsibilities

• Use a dedicated provider key for testing API invoice mode.
• Do not commit provider keys, CostLayers live keys, dashboard URLs, or generated secrets to source control. Rotate any key or dashboard URL that may have been exposed.
• Start with non-sensitive repositories until your team has reviewed the beta risk.
• Run your own quality gates and compare direct versus optimized workflow outcomes before trusting savings at scale.
• Disable response-cache opt-in if your policy does not allow provider responses to be stored for exact replay.
• Keep .agentspend/ private and out of source control unless you have reviewed the specific artifact for sharing. Verify the root .gitignore contains .agentspend/ if the CLI warned that it could not update the file.

Vulnerability Disclosure

If you find a security issue, email rishabh@costlayers.com with a description, affected endpoint or version, reproduction steps, impact, and proof-of-concept details. The unverified beta targets are acknowledgement within 2 business days and triage of plausible hosted-data reports within 1 business day. No operating-history SLA is claimed.

Incident Response

The readiness target is to contain affected services or keys, preserve evidence, assess data categories, notify affected users when appropriate, rotate secrets, and publish remediation guidance. The unverified beta notification target is within 72 hours after confirmation where legally and operationally feasible. No staffed on-call evidence, tabletop history, contractual SLA, SOC 2, ISO 27001, HIPAA, PCI, or FedRAMP claim is made.

Public Artifacts

Source review, target-state controls, gaps, and a non-authoritative subprocessor example are published at /docs/security-artifacts.html. The DPA summary is unsigned and non-contractual.

Enterprise Deployment

Teams that cannot route code-related traffic through unverified hosted infrastructure should stay on local-only paths. Private deployment, named subprocessors, a signed DPA, custom retention, key management, audit exports, deletion evidence, and support SLAs are review targets, not current commitments.