Security & Compliance All Tiers

Secure autonomous AI operations with PairCoder

Security Features

FeaturePurpose
Contained AutonomyFilesystem protection during autonomous mode
Security AgentsPre-execution gatekeeping
Command AllowlistsSafe vs unsafe command classification
Secret DetectionScan for leaked credentials
Webhook SecurityTrello webhook authentication

Meet Bellona

The pre-execution security gatekeeper is named after Bellona, the Roman goddess of war -- the defender who acts before the breach. She blocks dangerous operations before they execute, in contrast to her sister Laverna (the review-time security auditor who reports findings after the fact).

Agent Name Origin Role When Triggered
Bellona Roman goddess of war Pre-execution gate: scans commands, diffs, and PRs for credential exposure, dangerous operations, and policy violations. Blocks with clear explanations; warns on risky patterns. Before Bash tool calls, before commits, before PR creation

For the difference between Bellona (pre-execution blocking) and Laverna (review-time auditing), see the Review guide.

Contained Autonomy

Three-tier filesystem access control for autonomous AI operations:

TierAccessExamples
BlockedNo read, no write.env, credentials.json
Read-onlyCan read, cannot writeCLAUDE.md, .claude/skills/
Read-writeFull accesssrc/, tests/
bash 
# Enter contained autonomy mode
bpsai-pair contained-auto

# Check status
bpsai-pair containment status

# Rollback if needed
bpsai-pair containment rollback

Command Allowlists

Always Blocked

PatternReason
Hardcoded credentialsCredential exposure
rm -rf / or rm -rf *System destruction
curl | bash, wget | shArbitrary code execution
eval(user_input)Code injection

Always Allowed

PatternReason
git status, git diff, git logRead-only
pytest, bpsai-pairSafe tooling
cat, ls, grepRead-only utilities

Secret Detection

PairCoder scans for common secret patterns:

  • AWS Keys: AKIA[0-9A-Z]{16}
  • GitHub Tokens: ghp_[A-Za-z0-9]{36}
  • Slack Tokens: xox[baprs]-*
  • Private Keys: BEGIN.*PRIVATE KEY
bash 
# Scan staged changes
bpsai-pair security scan-secrets --staged

# Scan entire project
bpsai-pair security scan-secrets

# Install pre-commit hook
bpsai-pair security install-hook

SOC2 Compliance

ControlDescriptionPairCoder Feature
CC6.1Logical access securityCommand allowlists
CC6.6External threat protectionBlock dangerous downloads
CC7.1System change managementPre-commit review
CC7.2Change detectionScan all code changes

Best Practices

For Developers

  1. Never commit secrets - Use environment variables
  2. Pin dependencies - Specify exact versions
  3. Validate all input - Never trust user data
  4. Use parameterized queries - Prevent SQL injection

For AI Agents

  1. Always check allowlist before executing commands
  2. Scan staged changes before committing
  3. Block and explain rather than silently failing
  4. Request human review when uncertain