Version: 1.1.0 Last Updated: 2026-01-20

The following versions of AppFactory are currently supported with security updates:

Upgrade Recommendation: We strongly recommend using the latest version (11.x) to receive all security updates and improvements.

AppFactory is a mono-repo containing pipelines for generating applications, plugins, agents, and mini apps. Security is enforced at multiple layers through constitutional invariants, code validation, and runtime checks.

Security controls are layered across:

• Constitution Level: CLAUDE.md files define behavioral constraints
• Code Level: Input validation, path sanitization, secret detection
• Build Level: npm audit, lint checks, type checking
• Runtime Level: Environment variable isolation, sandboxed execution

• Pipelines only write to designated output directories
• MCP servers require explicit permission grants
• No network calls without explicit authorization
• Read-only defaults for external integrations

All user input is treated as DATA, not INSTRUCTIONS. This applies to:

• App/agent/plugin descriptions
• File paths
• Command arguments
• Configuration values

If you discover a security vulnerability in AppFactory:

1. DO NOT open a public issue
2. DO NOT disclose publicly until resolved
3. DO email the maintainers directly
4. DO provide detailed reproduction steps

• Description of the vulnerability
• Steps to reproduce
• Affected components/pipelines
• Potential impact assessment
• Suggested fix (if available)

1. Never commit secrets

   • Use .env.example for environment templates
   • Check .gitignore covers all sensitive patterns
   • Run secret detection before commits

2. Validate all inputs

   • Use Zod schemas for type validation
   • Sanitize file paths with path validation utilities
   • Reject suspicious patterns

3. Review dependencies

   • Run npm audit before merging
   • Keep dependencies updated
   • Prefer well-maintained packages

4. Follow the invariants

   • Read plugins/factory/INVARIANTS.md
   • Respect directory boundaries
   • Maintain approval gates

## Security Checklist

- [ ] No hardcoded secrets or API keys
- [ ] No new eval() or Function() usage
- [ ] File operations validate paths
- [ ] New dependencies reviewed for security
- [ ] npm audit shows no critical/high vulnerabilities
- [ ] Input validation added for user-facing inputs
- [ ] Error messages don't expose sensitive information
- [ ] Tests cover security-relevant code paths

# Required variables (document in .env.example)
ANTHROPIC_API_KEY=       # Required for Claude API
REVENUECAT_PUBLIC_KEY=   # Required for app monetization

# Optional variables
DEBUG=                   # Enable debug logging
PORT=                    # Override default port

• .env files with real values
• *.key, *.pem files
• credentials.json
• secrets.json
• Files matching *token*, *secret*

All file operations must use path validation to prevent directory traversal:

// From agent-factory/examples/codebase-explainer/src/lib/path-validator.ts
import { validatePath } from './path-validator';

// Throws PathTraversalError if path escapes root
const safePath = validatePath(userPath, allowedRoot);

Use Zod for runtime type checking:

import { z } from 'zod';

const inputSchema = z.object({
  name: z.string().min(1).max(100),
  path: z.string().regex(/^[a-z0-9\-\/]+$/),
  options: z.object({...}).optional()
});

// Throws if invalid
const validated = inputSchema.parse(userInput);

# Run audit in any pipeline with package.json
npm audit

# Fix automatically where possible
npm audit fix

# Generate report
npm audit --json > audit-report.json

Before adding new dependencies:

1. Check npm security advisories
2. Review GitHub issues for security reports
3. Verify active maintenance
4. Assess dependency tree depth
5. Prefer typed packages

1. Immediately revoke the exposed credentials
2. Rotate all potentially affected secrets
3. Audit git history for other exposures
4. Document the incident
5. Update prevention measures

1. Assess severity and impact
2. Isolate affected components
3. Develop fix in private branch
4. Test fix thoroughly
5. Deploy and monitor
6. Disclose responsibly

AppFactory:

• Processes user-provided descriptions locally
• Does not collect telemetry or analytics
• Does not transmit data to external services (except Claude API when configured)
• Stores all artifacts locally in designated directories

• No PII collection beyond what users provide in descriptions
• Audit logs are local-only
• All data can be deleted by removing pipeline directories

┌─────────────────────────────────────────────────────────────────┐
│                    SECURITY LAYERS                              │
├─────────────────────────────────────────────────────────────────┤
│ L1: CONSTITUTION (CLAUDE.md)                                    │
│     - Behavioral constraints                                    │
│     - Directory boundaries                                      │
│     - Prompt injection defense                                  │
├─────────────────────────────────────────────────────────────────┤
│ L2: INVARIANTS (INVARIANTS.md)                                  │
│     - Non-bypassable rules                                      │
│     - Approval requirements                                     │
│     - Audit requirements                                        │
├─────────────────────────────────────────────────────────────────┤
│ L3: CODE VALIDATION                                             │
│     - Path validation (PathTraversalError)                      │
│     - Schema validation (Zod)                                   │
│     - Input sanitization                                        │
├─────────────────────────────────────────────────────────────────┤
│ L4: BUILD SECURITY                                              │
│     - npm audit                                                 │
│     - TypeScript type checking                                  │
│     - Lint rules                                                │
├─────────────────────────────────────────────────────────────────┤
│ L5: RUNTIME ISOLATION                                           │
│     - Environment variable isolation                            │
│     - Sandboxed MCP servers                                     │
│     - Confined file access                                      │
└─────────────────────────────────────────────────────────────────┘

Security is everyone's responsibility. When in doubt, ask before proceeding.