Security model

Workflows run attacker-influenced inputs by nature: they fetch URLs, shell out, and feed model output into tools. Nika’s position is that the mechanism must be safe before policy makes it configurable — the dangerous primitives ship hardened by default, and a violation is a typed NIKA-SEC-* error your workflow can read, not a stack trace.

The threat model in one table

You write	The attacker controls	The defense
`invoke: nika:fetch`	the URL (or a page that redirects)	3-layer SSRF defense, on by default
`exec:`	argument values flowing from upstream tasks	shell blocklist + data-channel pattern
`infer:` → tool use	the fetched content the model reads	trust levels + spotlight + injection scanning
`secrets.*` bindings	log access	masked at the binding layer, never logged

SSRF defense (on by default)

nika:fetch refuses to be bounced into private space. Three layers, verbatim from the engine (nika-http):

Static checks (pure)

Scheme allow-list (http/https only), blocked hostnames (localhost, cloud metadata), literal-IP range checks — loopback, RFC 1918, link-local/metadata (169.254.169.254), CGN, IPv6 local ranges, v4-mapped v6.

DNS resolution check

Non-literal hosts are resolved and every address is range-checked — this kills decimal-IP tricks (http://2130706433/) and public names that resolve to private addresses.

Per-hop redirect re-check

Client-level redirects are disabled; the engine follows redirects itself and re-runs layers 1+2 on every hop. A public host cannot 302 the client into your VPC.

Response sizes are capped (64 MiB default) and self-signed TLS is rejected by default. Private-network access is opt-in configuration, never the default.

exec: the data-channel rule

exec in shell mode runs every command against a blocklist before spawn. But the structural defense is in how you write workflows — tainted data goes through data channels, never code channels:

# ❌ tainted output interpolated into a command string
- id: bad
  exec:
    command: "echo ${{ tasks.fetch_comment.output }}"

# ✅ tainted output passed as data
- id: good
  exec:
    command: tee
    args: ["/tmp/comment.txt"]
    stdin: "${{ tasks.fetch_comment.output }}"

Passing tainted data to a privileged sink without going through a data channel raises a typed taint violation — taint is a property of the data, not of who runs the workflow.

Trust levels + prompt injection

Content entering a workflow carries a trust level. Untrusted content (fetched pages, user comments) is tracked as it flows into prompts and tools:

Defense layer	Error surface
dangerous tool invoked on untrusted data → blocked	`NIKA-SEC` family (`security_error`)
strict-mode trust-level violation	`NIKA-SEC` family
exfiltration canary token found in output	`NIKA-SEC` family
prompt-injection scanner (+ ML detection)	`NIKA-SEC` family
untrusted data reached a prompt without spotlight wrapping	`NIKA-SEC` family
workflow recursion depth / self-launch blocked	`NIKA-SEC-003` (registered)

The three codes the spec REGISTERS today: NIKA-SEC-001 (exec blocklist hit), NIKA-SEC-002 (agent tool outside the whitelist), NIKA-SEC-003 (run-recursion bound). The runtime trust layers above are engine-side (the Shield) — they emit within the NIKA-SEC namespace as they land. Every failure is a typed error with a stable code and a transient flag — your on_error: can act on it.

Secrets

${{ secrets.* }} is a first-class namespace (vault/env/file-backed). Secret values are masked in logs and traces at the binding layer — they never appear in the event stream, and they are not readable back from a task’s recorded output.

Supply-chain hardening (the engine itself)

unsafe_code = "forbid" workspace-wide · zero .unwrap() in src/ (CI-enforced)
cargo deny on every PR · cargo audit on every dependency change
Sealed kernel traits — external code cannot impersonate engine I/O
lib tests · clippy warnings · every crate passes 12 admission gates
AGPL-3.0-or-later — the source travels with the binary, always auditable

Reporting a vulnerability

security@supernovae.studio — please not via public issues. Acknowledgement ≤72h, triage ≤7 days, disclosure ≤90 days. Full policy, disclosure process and the out-of-scope list: SECURITY.md.

Error codes

The NIKA-SEC namespace + every typed failure.

Bindings

Taint, scopes, and the secrets.* namespace.

Builtins — fetch

The nika:fetch contract (engines MUST ship SSRF defense).

SECURITY.md

Reporting, disclosure timeline, hall of fame.

​The threat model in one table

​SSRF defense (on by default)

​exec: the data-channel rule

​Trust levels + prompt injection

​Secrets

​Supply-chain hardening (the engine itself)

​Reporting a vulnerability

​See also