ALTA is experimental, research-only software. Its autonomous research runtime does not support live brokerage execution. A separate experimental connector package includes execution code, but is not wired into the autonomous runtime and has not passed real-account order acceptance. See the provider matrix for that boundary.

Use a private repository security advisory for ALTA-specific issues. Do not place a credential, cookie, account identifier, licensed market data, or unredacted log in any public tracker, message, source bundle, or CI output.

Report vulnerabilities reproducible in unmodified OpenAI Codex through OpenAI's responsible-disclosure program. Report provider or brokerage account vulnerabilities through that provider's security channel.

A useful report contains a minimal reproduction, affected version, impact boundary, and fully redacted logs.

Real provider or broker credentials may exist only outside the project tree: in a process environment controlled by the operator, an operating-system/external secret manager, or the owner-only external directory ~/.config/alta/credentials/. Project-local .alta/secrets/ contains only locally generated database/cache credentials and API/session secrets, and remains ignored.

Never put a real secret in:

• .env files, source, fixtures, snapshots, or documentation;
• source archives, review messages, generated reports, or build logs;
• agent prompts, tool arguments, API/SSE payloads, or model-visible state; or
• Compose literals and shell command arguments that can be logged.

.env.example contains empty placeholders and non-sensitive defaults only. Tests must use clearly synthetic values, and errors must redact authorization headers and credential-shaped fields.

The unattended host definition contains only absolute executable/workspace paths and lifecycle policy. Its mode-0600 service settings contain non-secret runtime controls; LLM, Massive, and Finlight values are loaded from the external owner-only credential boundary at process start. The generated dashboard bearer token remains in ignored mode-0600 .alta/secrets/ state and is never printed by status.

The loopback credential center is a write-only convenience layer over the same external boundary. It returns only configured state, provider purpose, source kind, editability, and a truncated one-way fingerprint. Exact-origin CSRF and the local HttpOnly session protect replacement; requests are size-bounded, provider-validated, atomically written, and refused whenever the research runtime is active. Environment-supplied values cannot be shadowed from the UI. Broker profiles use separate write-only forms and external owner-only storage. Saving a profile does not enable order submission or verify account permissions.

• Autonomous research environments are replay, shadow, and paper. Experimental broker profiles do not add an autonomous live mode.
• Research-agent child environments use an allowlist and exclude database, Redis, market-data, and broker secrets.
• Tiger is Paper-only. The system does not enumerate accounts, fall back to paper=false, or expose an HTTP order-mutation API.
• Capital code is an isolated locked package. Mutation is disabled by default and becomes reachable only after an authenticated operator authorizes the exact Paper account while the runtime is stopped, or through the explicit bounded acceptance command. Every expression must still pass the research, deterministic risk, and independent-audit gates.
• Every broker mutation is preceded by a durable Paper intent and revalidates the monotonic authorization generation while holding the account-global mutation lease. Ambiguous recent broker history enters manual_review and is never retried automatically; Tiger user_mark is not treated as a server-side idempotency guarantee.
• Revocation on an empty account disables mutation. Revocation while the one managed position remains enters close-only recovery: new buys are blocked, while only the durable exit may drain before final disablement.
• The acceptance executor requires an owner-only non-symlink config, exact 17-digit Paper account SHA-256 binding, empty starting account, bounded whole-share DAY limit orders, notional and broker-capacity admission, fresh dispatch quotes, fill reconciliation, confirmed cancellation, and final zero-position/zero-open-order verification.
• Research Agents receive neither Tiger credentials nor the executor tool.
• Market-data access uses bounded concurrency, explicit timeouts, and fail-closed admission.
• The gateway, database, cache, and observability API bind to loopback by default.
• Host installation refuses an occupied loopback endpoint. The host manager restarts only the project wrapper; the inner supervisor owns one database scheduler and terminates a stuck App Server process group before rebuilding.
• Missing, stale, or unauditable evidence becomes Wait; the system never invents a fill from a stale historical price.
• File tools reject workspace escape, hidden runtime state, and private-key or certificate formats.

Before publishing a commit or release:

corepack pnpm install --frozen-lockfile
corepack pnpm audit --audit-level=moderate
./alta test
./alta env setup --dev
./alta env python -m pytest -q alta-runtime/python/tests
uv run --project alta-runtime/capital-python pytest -q \
  alta-runtime/capital-python/tests
uv run --all-extras --project alta-runtime/broker-python pytest -q \
  alta-runtime/broker-python/tests
uvx --from detect-secrets==1.5.0 detect-secrets scan \
  --all-files --no-verify /absolute/path/to/clean-clone

Scan the exact clean clone in redacted mode, then scan the complete Git history with a second scanner. Compare exact local secret fingerprints without printing their values. The most recent audit record is docs/audits/security-audit.md.

Audit each supported package ecosystem from its lockfile. For the pinned Codex snapshot, run cargo audit --file Cargo.lock from vendor/openai-codex/codex-rs/. Advisory exceptions must be exact IDs, explain the dependency path and exposure, and state a concrete removal condition in both .cargo/audit.toml and deny.toml; a broad severity or vendor exemption is not acceptable.

The Node advisory gate includes development dependencies: build and documentation tools also process repository input. A production-only audit is insufficient. CI fails on moderate-or-higher advisories or an unavailable audit service; do not silence the gate with --prod or --ignore-registry-errors. Reviewed security patches may receive exact-version release-age exceptions while the general quarantine, integrity checks and publisher-trust policy remain enabled.

The optional .gitleaks.toml contains only exact-path exceptions for reviewed public test fixtures in the pinned Codex snapshot. Do not replace them with a broad vendor or file-extension exception.

If a real secret is found:

1. stop distribution;
2. revoke and rotate the credential at the provider;
3. remove it from every source and generated artifact;
4. rescan source bundles, build artifacts, logs, and caches; and
5. publish only after both the working tree and complete history are clean.

Deleting a local file does not replace provider-side credential rotation.

Security fixes target the latest release on main. Archived milestone documents and historical engineering records are not supported releases.

Codex sandbox and approval guidance is maintained in the official Codex security documentation.