Security & Compliance All Tiers

Secure autonomous AI operations with PairCoder

Security Features

FeaturePurpose
Contained AutonomyFilesystem protection during autonomous mode
Security AgentsPre-execution gatekeeping
Command AllowlistsSafe vs unsafe command classification
Secret DetectionScan for leaked credentials
Webhook SecurityTrello webhook authentication

Contained Autonomy

Three-tier filesystem access control for autonomous AI operations:

TierAccessExamples
BlockedNo read, no write.env, credentials.json
Read-onlyCan read, cannot writeCLAUDE.md, .claude/skills/
Read-writeFull accesssrc/, tests/
bash 
# Enter contained autonomy mode
bpsai-pair contained-auto

# Check status
bpsai-pair containment status

# Rollback if needed
bpsai-pair containment rollback

Command Allowlists

Always Blocked

PatternReason
Hardcoded credentialsCredential exposure
rm -rf / or rm -rf *System destruction
curl | bash, wget | shArbitrary code execution
eval(user_input)Code injection

Always Allowed

PatternReason
git status, git diff, git logRead-only
pytest, bpsai-pairSafe tooling
cat, ls, grepRead-only utilities

Secret Detection

PairCoder scans for common secret patterns:

  • AWS Keys: AKIA[0-9A-Z]{16}
  • GitHub Tokens: ghp_[A-Za-z0-9]{36}
  • Slack Tokens: xox[baprs]-*
  • Private Keys: BEGIN.*PRIVATE KEY
bash 
# Scan staged changes
bpsai-pair security scan-secrets --staged

# Scan entire project
bpsai-pair security scan-secrets

# Install pre-commit hook
bpsai-pair security install-hook

SOC2 Compliance

ControlDescriptionPairCoder Feature
CC6.1Logical access securityCommand allowlists
CC6.6External threat protectionBlock dangerous downloads
CC7.1System change managementPre-commit review
CC7.2Change detectionScan all code changes

Best Practices

For Developers

  1. Never commit secrets - Use environment variables
  2. Pin dependencies - Specify exact versions
  3. Validate all input - Never trust user data
  4. Use parameterized queries - Prevent SQL injection

For AI Agents

  1. Always check allowlist before executing commands
  2. Scan staged changes before committing
  3. Block and explain rather than silently failing
  4. Request human review when uncertain