Reviewing sgit's security with tools and agents
The question. sgit is operated by agents that hold vault keys. What does a security review of its key path look like when agents run it with published skills and tools, which of those find something the existing threat model did not, and how much of it can run on every pull request?
Where it stands
| Status | Where it is said | |
|---|---|---|
| Agent skills for security review, each checked at its source and ranked | research, 11 October | Security review skills |
| Threat-modelling tools, with the agent itself named as an actor | research, 11 October | Threat-modelling tools |
| The plan: one slice, five skills, three tools, joined to the register | accepted 11 October | The plan |
| Round 1 run on 0.21.0: 270 function records, 68 STRIDE threats, with counts per tool | done | The case study |
| A security workflow on every pull request; an AI review that can fail it, keyless | built; the AI review is off until connected | Security CI |
| Paths with characters outside a narrow set silently rewritten (AC-L-001) | documented 13 October, fix proposed | Refuse, don't rewrite |
| Pack mode reviewed before release by a second agent: a zip bomb, unverified member names, a gate that admitted older clients, and four ways compaction could strand a clone | fixed in 0.24.0, a test per finding, over four rounds on 21 and 22 October | round 1, 2, 3, 4; the story |
Articles from this topic
The research documents, newest first
Pack mode, round 4: the fixes at c5b326f2
The fourth round: no release blockers left. Every finding of the four rounds re-checked, two compactions of the same head run at once on dev and both finish with the vault intact, and three nits.
reviewPack mode, round 3: the fixes at 3f2c9bea
The third round: everything from round two fixed or accepted, both UX items fixed live, and one new data-loss path, caused by a round-two fix: an aborting compaction deleted a snapshot that another compaction had adopted. The fix was to delete two lines.
responseResponse to "Pack mode, round 3" (21 Oct 2026)
The answer to round three: the round-two clean-up was the bug, so an aborted compaction now leaves its snapshot; a 404 on an already archived pack is success; the gate exemption needs the hex form.
responseResponse to "Pack mode, verified again" (round 2, 21 Oct 2026)
The answer to round two: a clone chooses its snapshot by the branch head, a pack that names a member twice is refused whole, an aborted compaction takes its snapshot back, and the gate exemption checks every feature.
reviewPack mode, verified again: the fixes at 801b890c
The second round: six of the eight fixes hold, two are partial. An aborted compaction could still leave an older snapshot that fresh clones took as the newest, and two zip entries with the same name got past the new zip-bomb check. Checked live against sgit-ai 0.23.0 from PyPI.
responseResponse to "Pack mode, verified" (21 Oct 2026)
The CLI team's answer to the first verification round: all eight findings agreed and fixed with a test each, three more found in its own pass, and the how-to corrected.
reviewPack mode, verified: tests, a code review, and a live trial on dev
The first verification of pack mode, before release: the 4,511 tests, the tester's how-to run step by step on dev, a normal vault against a pack vault on the same server (a published 2,087-object vault cloned in 8.6 s against 28.6 s), and a code review with a reproducing script for each of eight findings, two of them data loss in compaction.
responseResponse to "Pack mode, round 4" (22 Oct 2026)
The answer to round four: no blockers, and the three nits done; "already gone" is decided by the status code, never by "404" inside a pack name.
designSecurity CI: a dedicated pipeline, and an AI review that can break the build
A dedicated security pipeline on every pull request, and a keyless AI security review that can break the build on anything new: why, how it is wired, and what it costs per reviewed change.
findingAC-L-001 / TM-R36 — characters outside [a-zA-Z0-9/\_.- ] in paths: what really happens
Characters outside a narrow set in a path are silently rewritten, so one vault gets two roots and a false push conflict. What really happens, reproduced, and a fix that raises an alarm instead of rewriting.
case studyCase study — a tool-assisted security review of sgit-ai 0.21.0 (round 1)
What each tool found in the round-1 security review of sgit-ai 0.21.0, with counts and cost: the skill vetting, the derived graph, 270 function records, 68 STRIDE threats and the insider overlay.
researchThreat-modeling tools for an agent-driven review — Matt Adams' stack, the classics, and the house method
Threat-modeling tools for an agent-driven review: Matt Adams' stack (STRIDE GPT, the insider-threat model), the classics, and the house method, with the agent itself named as an actor.
researchAgent skills for security review — what exists, what it would do here
Agent skills for security review, each checked at its source, ranked by whether it brings a method, a tool with deterministic output, or vets the other skills, against this code base.
planPlan — the next security review of sgit-ai, with skills, and the review graphs it produces
The plan for a tool-assisted, data-producing security review of one slice of sgit-ai: the code the zero-knowledge guarantee and the trust boundaries live in.
reviewReview: "Git security features → sgit: a one-way mapping
A review of the one-way map from git's security features to sgit, checked against the code: three corrections, one missing gap, and the four easy gaps closed for 0.21.0.
This page as markdown · its source, admin/content/research/topics/security-review.md