# DevOS v1 Security Specification

## 1. Threat Model
DevOS manages highly sensitive credentials:
- SSH keys
- API keys
- cloud tokens
- Git tokens
- SMTP credentials
- DNS API credentials
- database passwords

Therefore security is a core architecture boundary.

## 2. Credential Vault
Credentials are stored encrypted, separately from ordinary resource metadata.

```text
Application Master Key
        ↓
Envelope Encryption
        ↓
Encrypted Credential
```

Do not store plaintext passwords or tokens in PostgreSQL.

## 3. Authorization
Implement:
- authentication
- workspace isolation
- RBAC
- resource-level permission checks where required
- action-level authorization

## 4. Audit
All mutations and sensitive reads/actions should be auditable:
- actor
- workspace
- action
- resource
- risk
- outcome
- timestamp
- correlation/request ID

## 5. Secret Masking
Secrets must be masked in:
- logs
- UI
- Agent context
- error messages
- audit metadata
- tool results

## 6. AI Safety
AI execution must use the same authorization path as humans.

HIGH / CRITICAL:
```text
Plan
 ↓
User Approval
 ↓
Execute
 ↓
Verify
```

## 7. Infrastructure Execution
- SSH command execution must be scoped and logged.
- Command timeouts are mandatory.
- Production targets should be distinguishable.
- Destructive actions require explicit confirmation.
- Never allow prompt text alone to override security policy.

## 8. Security Non-Goals
This document does not claim a complete production security certification. Before public production deployment, perform threat modeling, dependency review, penetration testing and secret-rotation drills.