SECURITY.md

Security Policy

@takk/treasury is a stable (1.0.0) library for deterministic cost governance of Massive Intelligence (IM) agent orchestration. It forecasts model cost, enforces USD budgets, plans prefix-cache reuse, and routes a cheapest-first cascade over a ladder of models, entirely from the inputs you pass, with no network access and no telemetry. We take security reports seriously and aim to acknowledge each one within two business days.

Supported versions

Each published version follows strict SemVer (see SPEC.md and .github/RELEASING.md). Only the latest minor of the current major receives security patches; an older major receives critical-CVE fixes for 6 months after the next major lands.

Package	Supported
@takk/treasury	1.0.x (current latest dist-tag)

Reporting a vulnerability

Please do not file public GitHub issues for security problems. Send reports to davcavalcante@proton.me (preferred) or say@takk.ag (Takk relay), with the subject line beginning [SECURITY].

Include, at minimum:

• Affected version (npm ls @takk/treasury).
• Reproduction steps or a minimal proof-of-concept.
• Impact assessment (what an attacker can achieve).
• Any suggested mitigation.

PGP / signed reports are welcome but not required. If you need an out-of-band channel, ask in the first message and we will propose one.

Response process

1. Acknowledgement within 2 business days.
2. Triage and severity assignment within 7 days.
3. Fix targeted for the next release; critical issues ship as an out-of-band patch on the affected minor.
4. Coordinated disclosure: the reporter is credited in the changelog and advisory unless they request anonymity.

Threat model in scope

Findings in any of the following are in scope:

• Numeric integrity. Any way to drive a numerically invalid token count, price, or budget (NaN or Infinity) past the typed guards in the forecasting, budget, prefix-cache, or cascade arithmetic, or any accounting error that under-reports USD spend, lets a call breach a configured budget without raising the depletion event, or recommends an unprofitable cache write.
• Tool and adapter input. Any malformed input that bypasses validation and yields prototype pollution, an unbounded computation, or a corrupted result from model-supplied or user-supplied data.
• Loaders and snapshots. Path traversal or any way to make the JSON loaders in @takk/treasury/node read outside the path you pass them, or any crafted plan, price-table, or forecast file that bypasses the loader validation and yields a malformed descriptor, prototype pollution, or corrupted state.
• Supply chain. Tarball contamination, compromised npm scope, or a published artifact whose provenance attestation does not match the source commit.

Out of scope

• The correctness of the token estimates, prices, or price table you feed in. Treasury never fetches prices; it computes from the inputs you provide, and the accuracy of those inputs is your concern.
• The quality of the budgets, model ladder, or cache rules you configure. A poor budget or a poor ladder produces a poor plan; that is a usage concern, not a vulnerability.
• Spending outcomes that follow from acting on a forecast or plan. Treasury is a calculation library, not financial advice; how you use its authorizations and plans is yours to decide.

Supply-chain assurances

• Zero required runtime dependencies. Treasury bundles no third-party code, which eliminates the attack surface from transitive dependencies.
• Node-free, network-free core. The core makes no outbound network calls of its own and reads no files; all computation is local and deterministic. Only the optional @takk/treasury/node loaders touch the Node standard library (node:fs), and they only read and write the plan, forecast, and price-table files you point them at.
• Provenance. Every release is published with npm publish --provenance (SLSA attestation by GitHub Actions). Verify with npm view @takk/treasury@<version> --json | jq .dist.attestations.
• Lockfile committed. pnpm-lock.yaml is tracked in git for reproducible installs.