Security model

Identity and credentials

• Product agents use a selected-repository GitHub identity that excludes VectorCI.
• The VectorCI owner profile uses a separate owner-capable identity.
• The CLI never requests or returns token values.
• The GitHub App grants repository-scoped access.
• Workers receive job-scoped repository access only after signed admission.

Bounded setup writes

• Planning is read-only.
• Apply requires a freshly recomputed SHA-256 digest and exact confirmation.
• Only a missing regular .vectorci.yml may be created.
• Feedback submission creates only the exact digest-reviewed issue in the current product repository.
• Symbolic links, path escapes, parent or sibling repositories, provider source, overwrites, and public repositories are rejected.

Execution isolation

• Fork-originated code does not reach privileged or signing runners.
• Capabilities are routed exactly; a different operating system or device class is never equivalent proof.
• Signing and production deployment remain separate from pull-request validation.
• Ephemeral one-job workers are the default, with cleanup and terminal check publication required.

Public package boundary

The public npm package contains one standalone reviewed Node.js CLI bundle (vectorci), README, third-party notices, and package manifest. Runtime dependencies are bundled and the published manifest has no install-time dependencies. MCP servers, control-plane code, private registry and inventory implementation, source maps, credentials, and private filesystem paths are excluded.