plenum/SECURITY.md

Security

Reporting a vulnerability

Open a private issue on the repository, or contact the maintainer directly rather than filing a public issue. Please allow reasonable time for a fix before disclosing.

Known issue: database_query executes model-authored SQL

The database_query tool lets the model write and run SQL so it can answer aggregate questions ("how many speeches per party mentioned X?"). The SQL is passed to the database as written. There is currently no SELECT-only enforcement in the application.

This matters more than it might appear, because the corpus itself reaches the model's context. Speech and document text is fetched and shown to the model, so anyone who can get text into the parliament's record — which, in a parliament, is the point — can attempt a prompt injection.

Run plenum against a database role that only has SELECT. The application does not do this for you:

CREATE ROLE plenum_ro LOGIN PASSWORD '...';
GRANT CONNECT ON DATABASE plenum TO plenum_ro;
GRANT USAGE ON SCHEMA public TO plenum_ro;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO plenum_ro;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO plenum_ro;

The ingest pipeline needs write access and should use a separate role.

Enforcing this in the application — a read-only transaction plus a statement-type check on the tool path — is tracked and intended.

API keys

Users may supply their own model provider key in the browser. That key is held only for the duration of a request, is passed to background research jobs over the child process's stdin, and is never written to the database or to logs. The only persisted copy is the one the browser encrypts under the user's own password.

Server-managed keys come from environment variables and must never be committed. .gitignore excludes .env, .env.*, providers.yaml, key material and archives.

Chat privacy

Signed-in users' chats and research boards are stored encrypted with a key derived from their password. The server cannot read them. This means a forgotten password is unrecoverable by design.

Conversations are logged for evaluation only when the first message begins with TEST . Ordinary conversations are never written to the evaluation tables.