Security Architecture

The defense-in-depth isolation and security posture of NIKI.

Security Architecture & Posture

NIKI treats all repositories and agent-generated commands as untrusted input.

To protect developer machines and production codebases, NIKI enforces a strict multi-layer defense-in-depth security model:

┌─────────────────────────────────────────────────────────────┐
│                      Host Environment                       │
│  - OS keyring storage (not resolved by runtime providers)   │
│  - Spend caps enforced at stage boundaries                  │
│  - Git safety proof protects existing branch refs            │
└──────────────────────────────┬──────────────────────────────┘
                               │ Repository bind-mounted at /workspace
┌──────────────────────────────▼──────────────────────────────┐
│             Docker / Podman Container Backend               │
│  - Default discovery: rootless, then rootful fallback      │
│  - Dropped Linux capabilities (`CapDrop ALL`)               │
│  - PID, memory, and CPU limits                              │
│  - Network egress blocked by default                        │
│  - Narrow global command deny-list                          │
└─────────────────────────────────────────────────────────────┘

Security Invariants

Scoped Outbound Traffic: Provider calls are the baseline, but NIKI can also pull sandbox images, contact DuckDuckGo (niki research), fetch configured knowledge URLs, export OTLP, or use the remote MCP client. The current pipeline constructs an empty MCP manager, so configured MCP servers are not executed by a run.
Secret Redaction: Common API-key, bearer-token, password, and credential patterns are redacted from provider output and rendered reports.
Git Safety Is Not Sandbox Proof: safety_proof.json checks branch preservation, parentage, and history rewrite/force-push signals. It does not prove container settings or isolation, and the working tree is intentionally updated with the final diff.
Backend Boundaries: Rootless operation is a default discovery preference, not a guarantee; DOCKER_HOST can override socket discovery. Container runs modify the bind-mounted repository, while the worktree backend runs host-local processes without a container.