Security Policy
Relevant source files
The following files were used as context for generating this wiki page:
Introduction
Arbor is designed as a local-first impact analysis engine, prioritizing data privacy and security by ensuring that code analysis remains entirely offline. The security policy outlines the protocols for reporting vulnerabilities, the supported versions for security patches, and the architectural boundaries that define the project's security scope.
The scope of this policy covers the core components of the Arbor ecosystem, including the CLI (arbor-cli), the MCP Bridge (arbor-mcp), the Arbor Server (arbor-server), and the desktop Visualizer. By operating locally, Arbor avoids data exfiltration risks and the need for external API keys.
Sources: SECURITY.md:1-50, README.md:270-280
Vulnerability Reporting
The project maintains a structured process for reporting and resolving security vulnerabilities. Users are strictly advised not to open public GitHub issues for security concerns. Instead, reports should be sent via email to the maintainer.
Disclosure Process
The following flowchart illustrates the coordinated disclosure timeline once a vulnerability is reported:
The project commits to a 48-hour response time for initial reports and specific timelines for fixes based on impact.
Sources: SECURITY.md:11-30
Submission Requirements
When reporting a vulnerability, the following information must be included to facilitate a prompt resolution:
- Detailed description of the vulnerability.
- Step-by-step reproduction instructions.
- Assessment of the potential impact.
- A suggested fix, if available.
Sources: SECURITY.md:17-22
Architectural Security Scope
The security model distinguishes between internal components and external dependencies. Arbor's security responsibility is limited to its primary crates and visualizer.
In-Scope vs. Out-of-Scope
| Category | Components | Responsibility |
|---|---|---|
| In-Scope | arbor-cli, arbor-mcp, arbor-server, Visualizer | Arbor Maintainers |
| Out-of-Scope | Third-party dependencies | Upstream maintainers |
| Out-of-Scope | Issues requiring physical access | User/Environment |
Sources: SECURITY.md:32-41
Security Implementation Best Practices
Arbor implements several features to protect user data and maintain environment security. These range from network restrictions to data obfuscation in the user interface.
Network and Server Security
The Arbor Server operates on specific ports that should not be exposed to the public internet. The arbor serve command provides a --headless mode which determines the bind address.
pub async fn serve(port: u16, headless: bool, path: &Path, follow_symlinks: bool) -> Result<()> {
let bind_addr = if headless { "0.0.0.0" } else { "127.0.0.1" };
// ...
}
Sources: crates/arbor-cli/src/commands.rs:136-138
- WebSocket Security: Users are cautioned against exposing the WebSocket server on port 7433 to the public internet.
- Local Binding: By default, the server binds to
127.0.0.1unless explicitly put into headless mode for remote or containerized deployments.
Sources: SECURITY.md:46-47, crates/arbor-cli/src/commands.rs:136-160
Privacy and Data Handling
Arbor includes features specifically designed to protect privacy when sharing analysis results or screenshots.
- Spoiler Mode (GUI): The Visualizer includes a "Spoiler Mode" for file paths. This hides sensitive local directory structures by default, requiring a click to reveal.
- Graph Data Review: Users are encouraged to review the contents of
.arbor/directories before sharing them, as they contain a persistent semantic representation of the codebase.
Agentic Security (MCP)
The arbor-mcp component acts as a bridge for AI agents (like Claude). To maintain security while allowing AI to interact with the graph, the server utilizes a Spotlight mechanism. This ensures that when an AI agent queries a node, the visualizer focuses on that node, allowing the human user to monitor the AI's "attention" in real-time.
| MCP Tool | Security/Privacy Action |
|---|---|
get_logic_path | Triggers Spotlight on visualizer |
analyze_impact | Triggers Spotlight; returns structured JSON impact data |
find_path | Traces internal logic flow without data exfiltration |
Sources: crates/arbor-mcp/src/lib.rs:48-65, crates/arbor-mcp/src/lib.rs:155-165
Summary
The Arbor security policy emphasizes its Local-First nature, which inherently mitigates many traditional cloud-based security risks. By keeping the sled database and analysis engine entirely offline, users maintain full control over their source code. Security is further reinforced through responsible disclosure practices, default local network binding, and privacy-conscious UI features like path spoilers.
Sources: README.md:270-280, SECURITY.md:1-50