defense against the dark arts

secrets scanning

stop credentials from leaking before git push

# gitleaks: pre-commit & staging
gitleaks detect --source . -v --redact

# trufflehog: deep git history scan
trufflehog git file://. --only-verified

gitleaks: fast, standalone regex and entropy scanner for pre-commit hooks.
trufflehog: searches commit history and live-verifies whether discovered API tokens are active.

supply chain defense

audit dependencies for known CVEs and typosquats

# google osv vulnerability scanner
osv-scanner --lockfile=package-lock.json

# rust & node ecosystem audits
cargo audit
npm audit --audit-level=high

# filesystem & container scanner
trivy fs --severity HIGH,CRITICAL .

osv-scanner: queries the Open Source Vulnerabilities database against lockfiles.
trivy: comprehensive vulnerability, misconfiguration, and SBOM scanner.

process isolation

confine agent subshells to unprivileged sandboxes

# bubblewrap: unprivileged sandbox
bwrap --ro-bind / / \
      --bind ./project ./project \
      --unshare-all \
      --dev /dev bash

# firejail: lightweight profile sandbox
firejail --noprofile --private=./project bash

bubblewrap: creates unprivileged Linux user namespaces with read-only root mounts and isolated network namespaces.
firejail: restricts execution using Linux namespaces, seccomp-bpf, and capabilities.

agent evaluation & testing

test prompts and tool calls against red-team attacks

# promptfoo: automated prompt evaluation
npx promptfoo eval

# semgrep: static security analysis
semgrep --config "p/security-audit" \
        --config "p/secrets" .

promptfoo: industry-standard CLI for automated regression testing and injection red-teaming in CI/CD.
semgrep: static code analysis engine that flags insecure tool execution, shell command concatenation, and raw evals.

network egress control

intercept and block unexpected outbound sockets

# opensnitch: application-level firewall
systemctl status opensnitchd

# mitmproxy: inspect outbound agent traffic
mitmproxy --listen-port 8080

opensnitch: interactive application firewall that prompts when an agent or MCP process attempts outbound network connections.
mitmproxy: inspects outbound HTTP/S payloads to verify what data leaves the machine.

data protection & pii

scrub private customer data before model dispatch

# presidio: automated pii redaction
python -m spacy download en_core_web_lg
pip install presidio-analyzer presidio-anonymizer

presidio: Microsoft's production-grade PII detection and anonymization framework for redacting names, SSNs, and credit cards before prompts leave your network.

1. the dual-llm supervisor pattern

separate privileged decision-making from untrusted input

intuition: a judge never personally opens suspicious, unexamined packages sent to the courthouse. a clerk in a secure inspection room opens the package, logs the contents, and hands the judge a clean inventory sheet.

architecture: split the agent into two distinct models: a Privileged Supervisor and an Untrusted Worker. The Supervisor holds the system rules and authorized tools. When external data (web content, issues, repositories) must be read, the Supervisor delegates the task to the Worker. The Worker runs in an isolated sandbox with zero access to system tools, extracting only structured JSON. The Supervisor acts on verified data, neutralizing prompt injections before they can alter system control flow.

2. rigid typed tool schemas

eliminate raw shell string execution entirely

intuition: a bank deposit tube that only accepts standard cash envelopes, rejecting loose pipes, wires, or uninspected containers.

architecture: never provide an agent with an unrestricted run_bash(command: string) tool. Define granular, typed schemas using libraries like Zod or Pydantic (e.g. view_file(path, start_line, end_line), replace_content(path, target, replacement)). Execute system binaries using parameterized argument arrays (execFile("git", ["diff", "--stat"])), completely bypassing the shell interpreter and preventing command injection vulnerabilities.

3. git as the transaction buffer

make every filesystem modification atomic and reversible

intuition: a watchmaker lays pieces out on a clean tray before assembling the mechanism, so any misplaced gear can be set back immediately.

architecture: treat the git working tree as a transactional staging buffer. Every agent modification must be readable via git diff before it is committed. The agent must never commit or push autonomously. If an agent hallucinates, wanders, or introduces a vulnerability, an atomic rollback (git checkout -- . && git clean -fd) instantly restores the system to a verified, known-good state.

4. deterministic human-in-the-loop (hitl) fences

hard programmatic boundaries on side-effecting operations

intuition: the co-pilot can suggest flight adjustments and compute navigation, but the captain must physically confirm the throttle adjustment.

architecture: categorize agent tools into two clear risk tiers: Safe Read Tools (file viewing, directory listing, static code analysis) and High-Risk Side-Effect Tools (file writing, shell execution, external network requests, database transactions). The agent runtime must enforce a deterministic pause on any High-Risk tool invocation, displaying the exact parameters and diff to the human operator for explicit authorization.

1. micro-vm isolation over containers

shared containers are not a security boundary

intuition: staying in adjacent hotel rooms with thin drywall versus staying in freestanding concrete houses on separate parcels of land.

architecture: in a public or enterprise SaaS where agents execute user-supplied code or untrusted workloads, standard Docker containers share the host Linux kernel. A single kernel vulnerability (privilege escalation, dirty COW, eBPF bugs) allows container escapes and host takeover. Deploy hardware-virtualized micro-VMs: AWS Firecracker, Fly.io Machines, or gVisor (runsc). Each tenant's agent execution runs in a distinct virtual machine with its own isolated kernel.

2. multi-tenant vector store & memory isolation

prevent cross-tenant data exfiltration through retrieval

intuition: two people using the same filing cabinet, but each drawer has an independent mechanical lock that the other key cannot turn.

architecture: in RAG pipelines and long-term agent memory, never rely on soft application-level prompt filters to separate tenant records. Enforce database Row-Level Security (RLS) in PostgreSQL/pgvector or cryptographically distinct namespaces in vector databases (Qdrant, Pinecone). If Tenant A suffers an indirect prompt injection, the database itself mathematically rejects queries attempting to retrieve Tenant B's embeddings.

3. denial of wallet & circuit breakers

bound compute resources, tokens, and billing loops

intuition: an emergency shut-off valve on the main water pipe that automatically trips if flow exceeds safe limits for more than thirty seconds.

architecture: mitigate OWASP LLM04 by enforcing hard operational ceilings: (a) sliding-window token rate limiters per organization and user, (b) strict tool execution step ceilings (e.g. hard termination after 15 tool calls), (c) request timeouts (e.g. 60-second execution deadlines), and (d) cloud billing threshold webhooks that automatically downgrade frontier model access to local fallbacks upon budget exhaustion.

4. zero-trust egress & cloud metadata protection

neutralize ssrf and credential harvesting

intuition: an office mailroom that inspects every outgoing parcel, confiscating letters addressed to internal maintenance rooms or private safes.

architecture: cloud-hosted agent tools capable of making HTTP requests are prime targets for SSRF. Egress firewalls must drop all traffic to cloud metadata addresses (169.254.169.254 on AWS, GCP, and Azure) to prevent IAM credential theft. Block all RFC 1918 private subnets (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and route outbound internet traffic through forward proxies enforcing strict domain allowlists.

5. pii masking & enterprise secret management

keep customer data and api credentials off third-party logs

intuition: blacking out social security numbers and account numbers on legal documents with permanent marker before mailing them to external reviewers.

architecture: deploy enterprise secret managers (HashiCorp Vault, AWS Secrets Manager, Infisical) to issue short-lived, dynamic credentials with automated rotation. Never store plaintext tokens in environment files on shared hosts. Deploy automated PII redaction (Microsoft Presidio) at the API gateway, masking names, credit cards, and emails before payloads reach upstream frontier LLMs.

6. immutable cryptographic audit logging

tamper-evident forensic ledgers for enterprise compliance

intuition: a flight recorder sealed inside an armored black box that records every pilot action, instrument readout, and rudder angle.

architecture: required for SOC 2, ISO 27001, and HIPAA compliance: record an append-only, tamper-evident audit ledger capturing every user prompt, retrieved RAG context document, model reasoning step, exact tool invocation parameters, and execution output. Store audit records in WORM (Write Once, Read Many) cloud object storage (e.g. AWS S3 with Object Lock) for incident response and forensic analysis.

windows

# active listening sockets
netstat -ano | findstr LISTENING

# check if dev servers are exposed to lan
netstat -ano | findstr ":3000 :8080 :5173"

# firewall status across profiles
Get-NetFirewallProfile | Format-Table Name, Enabled

# untracked files the agent might see
git ls-files -o --exclude-standard
git check-ignore -v .env

linux

# active listening sockets and processes
ss -tulpn

# packet filter ruleset
nft list ruleset

# kernel security posture
sysctl kernel.kptr_restrict kernel.dmesg_restrict kernel.unprivileged_bpf_disabled kernel.yama.ptrace_scope kernel.randomize_va_space

# scratchpads must not execute binaries
mount | grep -E '/tmp|/dev/shm'

# audit setuid binaries across filesystem
find /usr /bin /sbin -perm -4000 -type f 2>/dev/null