Security at Roook

• Sign-in is Google through Supabase Auth. Supabase holds the account; the browser keeps the session in localStorage.
• The Roook server stores runs, each run's redacted event log (including what you type into the composer and chat) and counterexamples. Guest run quotas are counted per guest cookie and per client IP address, per day.
• If you connect GitHub, Roook stores your installation id and keeps short-lived installation tokens in memory only.
• In live runs, repo content and run data go to IBM Bob as prompts. Guest runs use recorded Bob answers.
• No analytics, ads or tracking scripts on the site or the app.
• You can delete a run, or all your data on the Roook server, from the web app. Runs older than 30 days and guest quota rows older than 2 days are deleted automatically.

Read the privacy policy

• The CLI runs your app in Docker as a non-root user with --cap-drop ALL, no-new-privileges and pids, memory and CPU limits.
• Only the workspace copy of your repo is mounted, never your home folder or the original. Ports are published on 127.0.0.1 only, and at run time the app gets an internal network wherever the app allows it.
• The sandbox gets none of Roook's environment, so Roook's keys never reach your app.
• The engine sends requests only to the sandbox's host and port, follows no redirects elsewhere, and uses a 10 s timeout and a 1 MB response cap.
• On the hosted site, guests run only allowlisted example repos pinned by commit SHA, with recorded Bob answers, in a process sandbox as a separate unprivileged user. The hosted server mounts no Docker socket, and hosted runs of your own repos are turned off. Run your own repo with the CLI on your machine.

• Every Bob agent is read-only except two: the Mechanic, which may write only under .rook-sandbox/, and the Surgeon, which may edit only the files in the reviewed diagnosis. A Surgeon change outside those paths is reverted and rejected.
• No agent gets command, browser or MCP tools. The engine runs commands, not Bob.
• Repo content is marked as untrusted data in every prompt, and every answer must match a strict JSON schema.
• Bob's output is never executed. Rules are checked with a safe expression evaluator (no eval or exec), and actions are declarative HTTP templates.
• Only the engine marks a rule broken or a fix verified. Approving rules, applying a fix and opening a pull request need your answer, or --auto, which still ends on a branch for review.

• Secrets live only on the host: never in git, logs, events or the web bundle.
• A redaction filter scrubs keys and tokens from every event, log line and error before it is stored or sent.
• The Bob key reaches Bob only through the child process environment, never on the command line.
• The browser gets only the Supabase project URL and its public key.

• Google sign-in uses Supabase Auth with PKCE. Sign-out is local to the browser.
• The server verifies the Supabase token on every call. Guests get a signed, httpOnly guest cookie.
• Every run route checks the owner and answers 404 to anyone else, so run ids don't leak.
• The Roook GitHub App asks for the minimum: Contents read & write, Pull requests read & write, Metadata read. Webhooks are verified with HMAC, and installation tokens are scoped to one repo.
• Roook never pushes to your default branch: fixes land on a rook/fix-* branch, as a pull request for a GitHub repo.

• A Content Security Policy with a per-request nonce, plus Referrer-Policy, X-Content-Type-Options, X-Frame-Options and a Permissions-Policy that turns off camera, microphone, geolocation and payment.
• Rate limits on the API (60 requests per minute per IP, 10 per minute to start runs) and daily guest quotas.
• Every request body is validated against a schema, with a 64 KB size limit.
• Repo files, Bob output and diffs are rendered as escaped text in the web app.