Deployment ladder
- Process invocation through CLI
- Persistent local HTTP sidecar
- Versioned file exchange
- Partner-local worker
- Embedded adapter or sidecar
- Private deployment, where supported
Target authorization
The partner is responsible for selecting and authorizing the target. Do not allow customer-controlled input to become arbitrary command execution or unrestricted filesystem access — pass arguments as arrays, validate paths, and constrain output directories, as covered in the CLI quickstart.
Local API boundary
When a sidecar is used:
- Bind to loopback by default
- Authenticate local callers where practical
- Reject unsupported modules rather than silently ignoring them
- Constrain target and output paths
- Enforce timeouts and support cancellation as a distinct outcome
- Sanitize request and error logs
- Never return secrets in a response body
Output boundary
Evidence and diagnostics may contain source locations, prompts, traces, configuration, customer identifiers, findings, and local filesystem paths. Apply retention, redaction, and access controls appropriate to your deployment — SecEng does not assume a specific compliance posture on your behalf.
Support boundary
Collect the smallest useful diagnostic package. Do not upload customer source, secrets, regulated data, or unredacted traces unless explicitly approved — see diagnostics and support.