Security posture & disclosure.

Posture

{ai} engineering is a security boundary, so an attack on it is a vulnerability and a guard bypass is critical by definition. It runs on your machine: the payload is the binary. The state is files in your repository and in ~/.ai-engineering/. There is no hosted control plane, no account and no telemetry — your code, your prompts and your receipts stay where they are written.

The one outbound read is an anonymous daily registry version check, cached for 24 hours and silent when offline. Turn it off with notices = false in config.toml, or AI_ENG_NO_UPDATE_NOTICES=1.

Two properties hold by construction: ai-eng update never touches the network — it re-plants from the binary you already installed — and the release assets are verified by attestation, not only by a checksum fetched from the same origin.

Built under its own gates

The framework is held to the same security checks it ships. Each release runs through:

• gitleakssecret scanning over the staged diff and the history
• semgrepstatic analysis, pinned, with metrics off
• trivydependency and misconfiguration scanning
• SonarCloudcontinuous quality and security review
• Snykdependency vulnerability monitoring
• SBOMa software bill of materials per release
• signed provenancerelease assets verified by attestation, not only by a checksum fetched from the same origin

The guards are what enforces this in the hot path: a tool call that would skip the git floor, unhook the agent, silence a check or repeat a failing edit is denied before it runs, and turning one off needs a written reason and an expiry date in .ai-engineering/overrides.toml.

Reporting a vulnerability

If you believe you’ve found a security issue, please report it privately so it can be addressed before public disclosure. Do not open a public issue for security reports.

[email protected]

Include affected version, reproduction steps, and impact where you can — it helps us triage faster.