Security · Project Spine

CLI

No implicit network calls.spine learn --case, spine replay, spine guard, spine context, spine report, spine init, spine compile, spine inspect, spine export, spine template, spine explain, and spine drift check run entirely offline. spine doctor verifies that local posture. The only routed network paths require an explicit command: GitHub metadata import with learn --from-pr or design-token pull with an explicit Figma file key and FIGMA_TOKEN.
No repo upload path.The routed OSS CLI reads your repo and writes generated files locally. It does not upload source, briefs, generated exports, or drift reports to Project Spine.
Opt-in LLM enrichment.Rationale enrichment via Anthropic's API is opt-in per command and requires an explicit key in env. Prompts run through a secrets scrubber (PATs, API keys, PEM blocks) before leaving your machine.

Replay does not check out commits.Historical verification reads Git objects. It does not move HEAD, alter the index, or rewrite the working tree.
Evidence is local data.Case files, verified rules, and HTML reports remain on disk unless you choose to commit or share them.
Rules are literal and reviewable.The beta evaluates scoped require-text and forbid-text checks. It does not execute code from evidence or ask a remote model to decide whether a diff passes.
Executable corrections require explicit consent.The source-available correction pilot runs only user-reviewed, captured test and source bytes after --allow-execution. Execution uses a digest-pinned Docker image with networking disabled, a read-only root filesystem, a non-root user, and bounded resources. Current-tree checks revalidate those controls; no-execution correction context is always labelled candidate.
Agent evaluation is an explicit execution boundary.spine evaluate runs only with --allow-execution. It creates temporary clones and invokes the adapter you configure. There is no OS sandbox; that adapter can execute local programs, use the network, call a model, and incur provider costs. Historical spine replay never does this. Read the evaluation security contract before enabling it.

CSP with per-request nonce.script-src 'self' 'nonce-<fresh>' 'strict-dynamic', with no 'unsafe-inline' on scripts. Middleware mints a fresh nonce per request; every route renders dynamically so Next stamps it onto its inline RSC payload scripts.
Transport.HTTPS only. .dev is HSTS-preloaded at the TLD; we additionally send Strict-Transport-Security: max-age=63072000; includeSubDomains; preload.
Plus X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy locking out geolocation / microphone / camera.
XSS on public rationale URLs.Markdown is rendered via marked and then passed through sanitize-html with an allowlist. Scripts, iframes, inline styles, and javascript: schemes are stripped. Rationales set noindex, nofollow.

Your repo source.The routed CLI runs offline for compile and drift. The website never receives repo source, generated exports, briefs, or drift reports from the OSS workflow.
Repo-source analytics.The website loads Google Analytics for aggregate site measurement, but the public CLI workflow still uploads no repo source, briefs, generated exports, or drift reports. Check the site's Content-Security-Policy header in devtools. connect-src allows 'self', api.github.com, and registry.npmjs.org for product features, plus Google Analytics and Ahrefs endpoints for measurement.
Request bodies in logs.Vercel logs access lines (IP, path, status, timestamp) only, retained per Vercel's policy. Tokens never appear in logs; API routes don't print auth headers.

Email security@projectspine.dev or use GitHub private vulnerability reporting on the repo. Acknowledgement within 72 hours, initial assessment within 7 days, coordinated disclosure on a timeline agreed with you.