SECURITY & AUDITING
Security Scanners & Invariants
Semgrep SAST, Trivy container and misconfiguration scanning, and dependency vulnerability auditing.
Core Security Invariants
- • Safe Subprocess: Uses direct argument arrays (Command::new(cmd).args([...])), avoiding any shell interpretation.
- • Path Traversal Defense: Every path is verified with is_safe_subpath to prevent directory escapes.
- • Zero Credential Exposure: Tokens and secrets are sanitized from logs and error diagnostics.
- • Strict Containment: External tools execute in unprivileged sandboxes with pre-allocated buffer limits.
Running Security Audits
# Run full security audit suite:
$ aek security audit
# Run doctor to inspect scanner availability:
$ aek security doctor