# ⚠️ SECURITY WARNINGS - READ BEFORE USING

## 🚨 CRITICAL: This is Pre-MVP Software

**4Runr OS is under active development and NOT SAFE for production use.**

---

## Known Security Vulnerabilities

### 🔴 CRITICAL

1. **Arbitrary Code Execution**
   - ~~Custom tools can execute arbitrary code~~ **(MITIGATED: Tool testing disabled)**
   - Custom tools stored in `~/.4runr/tools.json` could still contain malicious code
   - **DO NOT** create or import tools from untrusted sources

2. **Command Injection**
   - Multiple `execSync` calls throughout the codebase
   - Potential for shell command injection in certain code paths
   - **Risk:** Arbitrary command execution

3. **Path Traversal** **(PARTIALLY MITIGATED)**
   - ~~Usernames were not validated~~ **(FIXED: Now validates usernames)**
   - Other file operations may still be vulnerable
   - **DO NOT** use untrusted input for file paths

### 🟠 HIGH

4. **Unencrypted Credentials**
   - Configuration files stored in plain text
   - Session tokens unencrypted in `~/.4runr/session.json`
   - **Risk:** Credential theft by other processes

5. **SSRF (Server-Side Request Forgery)**
   - Gateway URL can point to internal services
   - **Risk:** Access to localhost services, cloud metadata, internal network

### 🟡 MEDIUM

6. **No Input Validation**
   - JSON parsing without schema validation
   - Environment variables trusted without checks
   - **Risk:** Application crashes, data corruption

7. **Insecure Updates**
   - Automatic npm updates without integrity verification
   - **Risk:** Supply chain attacks

---

## What We've Fixed

✅ **Removed hardcoded server IP** (Version 2.1.55)  
✅ **Disabled unsafe tool execution** (Version 2.1.56)  
✅ **Added username validation** (Version 2.1.56)  
✅ **Improved file permissions** (Version 2.1.56)  

---

## Safe Usage Guidelines

### ✅ DO:
- Use in isolated, non-production environments only
- Run with standard user privileges (not root/admin)
- Review the full security audit: [SECURITY-AUDIT.md](./SECURITY-AUDIT.md)
- Keep the package updated
- Report security issues responsibly

### ❌ DON'T:
- Use in production
- Store sensitive data
- Connect to untrusted gateways
- Execute untrusted custom tools
- Run with elevated privileges
- Use on shared systems

---

## Reporting Security Issues

**DO NOT** open public GitHub issues for security vulnerabilities.

Contact: team@4runr.com (security@4runr.com)

Please include:
- Vulnerability description
- Steps to reproduce
- Potential impact
- Suggested fix (if available)

---

## Disclaimer

THIS SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. USE AT YOUR OWN RISK.

The maintainers are not responsible for:
- Data loss
- Security breaches
- System compromise
- Any damages arising from use

---

## Timeline to Production-Ready

**Current Status:** Pre-MVP (Not Safe)  
**Target:** MVP with security fixes  
**ETA:** TBD

Security issues must be resolved before MVP release:
- [ ] Remove/sandbox code execution
- [ ] Encrypt credentials at rest
- [ ] Add JSON schema validation
- [ ] Implement SSRF protection
- [ ] Professional security audit
- [ ] Penetration testing

---

**Last Updated:** 2026-02-04  
**Version:** 2.1.56
