<!-- source: https://deepwiki.com/qhkm/zeptoclaw/6-security -->

# Security

- src/audit.rs
- src/cli/secrets.rs
- src/kernel/gate.rs
- src/safety/chain_alert.rs
- src/safety/mod.rs
- src/security/encryption.rs
- src/security/mod.rs
- src/security/mount.rs
- src/security/path.rs
- src/security/shell.rs

This page provides an overview of ZeptoClaw's security architecture and defense-in-depth strategy. ZeptoClaw implements a multi-layered security model to protect against prompt injection, code execution attacks, data exfiltration, and resource exhaustion.

For specific implementation details, see:

- Security Architecture — Defense-in-depth overview, six security layers, and threat model
- SafetyLayer Components — Injection detection (21 patterns), leak scanner (22 patterns), policy engine (7 rules), and taint tracking
- Agent Mode Policies — Observer/Assistant/Autonomous modes, category permissions, and approval gates
- Shell Security — Allowlist/blocklist configuration, shell escaping, command validation, and SSRF prevention
- Container Isolation — Detailed coverage of Landlock, Firejail, Bubblewrap, Docker, and Apple Container backends
- Encryption and Key Management — Master key derivation, ENC[...] values, pairing tokens, and TokenStore encryption
- Loop Guards and Circuit Breakers — SHA256 signature tracking, threshold detection, and loop termination

## Defense-in-Depth Model

ZeptoClaw employs **six independent security layers** that protect the system at different stages of request processing. Each layer can independently block execution, providing cumulative protection against multiple attack vectors. The core of this enforcement is the `ZeptoKernel`, which assembles these subsystems at boot.

### Security Flow Overview

The following diagram maps the high-level security flow to specific code entities and enforcement points.

```

```

**Sources:** [src/kernel/gate.rs131-175](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/kernel/gate.rs#L131-L175) [src/safety/mod.rs132-151](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/safety/mod.rs#L132-L151) [src/security/mod.rs1-21](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/security/mod.rs#L1-L21)

## Core Security Mechanisms

### SafetyLayer and Policy Engine

The `SafetyLayer` orchestrates the `ContentValidator`, `LeakDetector`, and `PolicyEngine` [src/safety/mod.rs99-105](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/safety/mod.rs#L99-L105) It performs field-aware scanning for filesystem tools via `scan_tool_input`, allowing file bodies to contain code while strictly validating paths for shell injection [src/kernel/gate.rs65-117](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/kernel/gate.rs#L65-L117)

- Policy Engine: Fast first-pass detection of system file access, SQL injection, and shell injection patterns src/safety/mod.rs 103
- Leak Detector: Scans for 22 types of sensitive strings including API keys and PEM keys src/safety/mod.rs 182-194
- Chain Alerting: The ChainTracker detects suspicious tool call sequences like filesystem_write followed by shell_execute or shell_execute followed by web_fetch src/safety/chain_alert.rs 12-35
- For details, see SafetyLayer Components .

### Taint Tracking

ZeptoClaw implements data-flow-aware taint tracking via the `TaintEngine` [src/safety/mod.rs10](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/safety/mod.rs#L10-L10)

- Sinks: The execute_tool function calls engine.check_sink to block tainted data from entering sensitive tools like shell or web_fetch src/kernel/gate.rs 157-168
- For details, see SafetyLayer Components .

### Path and Mount Security

Filesystem operations are restricted to a defined workspace.

- Path Validation: The SafePath type ensures paths are normalized and stay within workspace boundaries, checking for symlink escapes src/security/path.rs 16-31 src/security/path.rs 140-183
- Mount Validation: Runtime mounts are validated against an allowlist to prevent exposure of sensitive host paths like .ssh , .aws , or .kube src/security/mount.rs 12-27 src/security/mount.rs 165-215
- Shell Filtering: Regex-based patterns block dangerous shell operations (e.g., reverse shells, fork bombs, destructive root operations) src/security/shell.rs 107-158 It also includes specialized normalization for git commands to prevent bypasses via global options src/security/shell.rs 49-98
- For details, see Shell Security .

### Encryption and Secrets

Sensitive configuration fields are protected using `SecretEncryption` [src/security/encryption.rs44-46](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/security/encryption.rs#L44-L46)

- Algorithm: Uses XChaCha20-Poly1305 with Argon2id for key derivation src/security/encryption.rs 1-13
- Format: Secrets are stored as ENC[version:salt:nonce:ciphertext] strings src/security/encryption.rs 101-103
- CLI Management: The secrets command provides encrypt , decrypt , and rotate functionality src/cli/secrets.rs 14-20
- For details, see Encryption and Key Management .

## Tool Execution Gate

The `execute_tool` function in the kernel serves as the primary enforcement point for all security policies during tool invocation. It integrates safety scanning, taint tracking, and audit logging into a unified pipeline.

```

```

**Sources:** [src/kernel/gate.rs131-175](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/kernel/gate.rs#L131-L175) [src/audit.rs76-86](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/audit.rs#L76-L86)

## Security Components Code Map

**Sources:** [src/kernel/gate.rs119-130](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/kernel/gate.rs#L119-L130) [src/safety/mod.rs99-105](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/safety/mod.rs#L99-L105) [src/security/mod.rs1-21](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/security/mod.rs#L1-L21) [src/audit.rs120-122](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/audit.rs#L120-L122) [src/security/shell.rs107-158](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/security/shell.rs#L107-L158)
