Pin, inspect, minimize access, and fail closed.

Supply-chain guidance

Install from the public package index with pip install evalt. Review the public source, pin the resolved version before production use, and trial it on a noncritical route. evalt doctor prints the imported package, interpreter, and corrective command without printing workspace secrets.

Workspace access

• Existing evw_ owner capabilities retain full authority and should not be placed in CI.
• Delegated evc_ capabilities have Viewer, Publisher, or Editor permissions enforced on every server request.
• Delegated secrets are displayed once; only a domain-separated SHA-256 digest and bounded grant metadata are stored.
• Capabilities must expire, can be revoked immediately, cannot escalate, and cannot create more access.
• Share links use URL fragments, which are removed after local consumption and are not sent as request paths or referrers.

Network and secret boundaries

Provider credentials remain local or in the current browser session and are not stored in workspace records. Signed webhook delivery verifies HTTPS, rejects redirects and private/local destinations by default, pins the resolved public address for the connection, bounds response size and timeout, and uses HMAC signatures plus stable idempotency IDs. CI accepts only delegated workspace capabilities and rejects owner keys.

Hosted storage and browser policy

Hosted records are encrypted before local or R2 persistence. API responses use no-store, nosniff, origin-restricted CORS, a restrictive Content Security Policy, no-referrer, and disabled camera, microphone, and geolocation permissions. Dashboard outages never fail a local production route.

Report a vulnerability

Use the repository’s private vulnerability-reporting flow when available. If GitHub does not offer that flow, open a minimal public issue requesting a private channel—do not include exploit details, credentials, customer data, or secrets.