ArchSutra AI / Handbook

Security, privacy and legal

Security model, privacy guarantees, license, trademarks, disclaimers, and what has not been checked.

Version 0.1.0 · Source: docs/handbook/07-security-privacy-legal.md

This document describes the project's design and intentions. It is not legal advice. For decisions with legal effect, consult a qualified lawyer.

1. Security model#

Full analysis: threat model.

Known limitations#

• Prompt injection against the host model cannot be fully prevented by instructions. Keep agent permissions minimal and review proposed actions.
• Redaction is pattern-based and can miss unusual secret formats.
• Heuristic rules have false positives and false negatives.
• Adapter file layouts have not been smoke-tested in the live hosts.

Reporting a vulnerability#

Use GitHub private vulnerability reporting: https://github.com/shahvatsalofficial/archsutra-ai/security/advisories/new. See SECURITY.md.

2. Privacy#

• Data collected by ArchSutra: none. No telemetry, analytics, crash reports, or network calls from the CLI.
• Where your code goes: nowhere from the CLI. When you use the skills, your code and prompts are processed by your AI IDE and its model provider under that provider's terms. ArchSutra does not control or see that traffic.
• What reports contain: file paths, line numbers, short redacted excerpts, rule text. Review reports before publishing them; paths and excerpts can reveal internal structure.
• Generated HTML docs: the handbook site loads one script from the jsDelivr CDN to draw diagrams. That request exposes the visitor's IP address to the CDN operator, as any CDN request does. No analytics are included.

3. Licensing#

• Project license: Apache License 2.0 (LICENSE). Permits commercial use, modification, distribution, and patent use, with attribution, notice retention, and no trademark grant.
• NOTICE must be retained in redistributions.
• No runtime dependencies. Dev dependencies: TypeScript (Apache-2.0), @types/node (MIT). Details: THIRD_PARTY_NOTICES.
• Contributions: under Apache-2.0 section 5 (inbound = outbound), unless stated otherwise.
• Referenced standards (OWASP, C4, SARIF, Mermaid, STRIDE, Agent Skills) are cited by name and link; no text is copied.
• Original content: the skills, agents, rules and documentation are original work by the creator and contributors.

4. Names, trademarks and affiliations#

• "ArchSutra", "ArchSutra AI" and "ArchSutra Prime" are used by this project. No trademark search or registration has been performed. On 2026-10-31 the npm names archsutra and archsutra-ai were unclaimed and GitHub search found no other repository named archsutra. That is a spot check, not legal clearance. Do a proper search before any commercial launch, paid product or registration.
• Third-party names (Claude, Claude Code, Anthropic, Cursor, OpenAI, Codex, GitHub, GitHub Copilot, Google, Gemini, Node.js, npm, OWASP, Mermaid) belong to their owners. They appear only to describe compatibility (nominative use). This project is not affiliated with, endorsed by, or sponsored by any of them.

5. Disclaimers#

• No warranty. Provided "AS IS" (Apache-2.0 sections 7 and 8).
• No compliance claim. Reports are review aids. They do not certify conformance with any law, regulation or standard (including GDPR, HIPAA, PCI DSS, SOC 2, ISO 27001, NIST, OWASP). Mentions of frameworks are references for human reviewers.
• No security guarantee. Absence of findings does not mean absence of vulnerabilities. Do not rely on this tool as the sole control.
• Authorized use only. Run the tool only on code you own or are authorized to review. The CLI does not scan networks or run exploits.
• AI output. Skill-driven results come from third-party models and can be wrong. Verify before acting; the skills instruct the model to cite evidence so you can.

6. Open legal and compliance checks (not done)#