The safety model

An operator you can audit.

Letting a machine run a shop is only reasonable if the machine cannot do anything you did not permit, and cannot do anything quietly. These are the mechanisms that make that true — each one is code in the engine you own, not a promise about our conduct.

  • scope

    Tools are allowlisted, not open-ended

    The admin assistant can reach 37 named tools and nothing else. API keys carry one or more of 21 scopes, and every invocation is checked against the scope the tool declares — not against the caller’s intent.

  • confirm

    Writes stop and wait for a person

    Twenty-five write tools return a preview instead of executing. Execution requires a confirmation token the server issued and the UI round-tripped. The model cannot set that flag itself — it is stripped from arguments before the first call.

  • read

    Suggest mode blocks every write

    A request flag that hard-disables the write half of the toolset, for when you want the assistant to propose and nothing else.

  • audited

    Every call is recorded, and reversible

    Each invocation writes an audit row with the actor typed by origin — API key, admin user, storefront chat, voice — and sensitive values redacted. Attempts that were refused are recorded too. Mutations can be reverted from the log.

  • limit

    A session cannot run away

    Tool calls are capped per assistant session, and the AI routes are rate-limited per admin user. Voice sessions carry their own per-session and per-day minute caps.

  • gate

    Agent surfaces are off unless you turn them on

    ACP checkout, A2A, WebMCP, UCP identity linking and the voice shop all default to off, and answer 404 the way an absent path does — not 403, which would confirm the feature exists.

Reporting a vulnerability

Please do not open a public issue — that discloses the flaw to attackers before a fix exists. Use GitHub’s private vulnerability reporting on the template repository: Security → Report a vulnerability. It opens a private thread only you and the maintainers can read.

Include the affected version or commit — scaffolded shops carry it in .cartwright/release.json — plus impact and reproduction steps.

Open a private report →
scope
create-cartwright, cartwright.app, the public template
first response
within 48 hours
critical fix
target 7 days
disclosure
GitHub advisory, after users can upgrade

Published advisories

  • CW-2026-002Next.js 16.2.11 — the July security release, covering nine CVEs.fixed v0.41.0
  • CW-2026-001Public-surface lockdown: the MCP endpoint and tool catalogue now honour the mcpPublic flag, and API keys actually expire.fixed v0.40.0