Security

Disclosure & Threat Model

Puffer is a security project — vulnerabilities have outsized impact on every system Puffer protects. Treat reports privately.

🔒

Reporting a vulnerability

Do not file public GitHub issues for security problems.

Email [email protected] with reproduction steps, affected version and your assessment of impact.
You will receive an acknowledgement within 72 hours.
We aim to ship a patch within 14 days for high-severity issues, 30 days otherwise.
Reporters are credited in the release notes unless they ask to remain anonymous.
We follow coordinated disclosure — please do not publicize until a fix is released.

› What we promise

🏠

Local-first

Puffer runs entirely on your machine. Requests are inspected before they leave, responses are inspected before they reach the agent. No traffic, payloads, telemetry or audit data is sent to any cloud service by default.

🔇

No telemetry

Zero outbound connections from the daemon. There is no opt-in analytics, no ping home, no usage reporting. What you log stays in ~/.puffer/audit.jsonl on disk.

📖

Open source — Apache 2.0

Every layer, rule, heuristic and decision threshold is auditable. You can read, fork, harden and ship your own rules. Community detection rules are signed before being trusted.

👁️

Monitor mode by default

On a fresh install Puffer never blocks. It observes, audits and reports — letting you measure before you enforce. Switching to enforce, paranoid or interactive mode is always an explicit user action.

› Threat model

"Assume the agent will be compromised — contain the blast radius."

Compromised AI agent

Assume the agent will be tricked, jailbroken or hijacked. Puffer assumes nothing about the agent's intent — it gates the actions the agent tries to perform.

Prompt injection in retrieved content

External documents, web pages and tool outputs are treated as untrusted. The injection layer classifies them with separate thresholds before they ever shape an LLM request.

Credential and PII exfiltration

The PII scanner runs on every outgoing payload — SSNs, credit cards, API keys, JWTs, private keys, and ~/.aws / ~/.ssh material are detected before the request leaves the host.

Dangerous shell execution

The command analyzer blocks fork bombs, recursive deletes, privileged docker runs and curl-pipe-bash by default; sudo and publish operations require explicit approval.

Unauthorized MCP servers

The MCP layer enumerates the tool surface and detects new or unexpected MCP endpoints injected at runtime, plus tool-result poisoning attempts.

Out of scope

Issues that require attacker control of the host filesystem before Puffer starts.
Bypasses of paranoid mode that depend on disabling the daemon (mode is enforced inline, not via signature).
Detection-evasion techniques that fail open by default (we explicitly want false positives over false negatives in monitor).