Security is the product.
XR separates authority from intelligence: a deterministic policy gate, human approval, spend ceilings, and a tamper-evident audit log.
Authority is not intelligence
A model proposes; policy, approval and budget grant. The gate runs even when the model is wrong or manipulated.
Deterministic policy gate
Egress allow-listing, secret-path denial, and dangerous-command blocking are evaluated in-process before any tool runs — independent of what the model decided.
Secrets stay yours
BYOK: provider keys are read from your environment. The credential vault encrypts stored integration secrets with AES-256-GCM envelope encryption.
Human-in-the-loop
Confirm dangerous actions before they execute. Configure policies by skill, repository, and risk level.
Governed extensibility
Plugins declare permissions and are disabled by default. Nothing is loaded until you enable it.
Tamper-evident audit
Every consequential action is appended to a hash-chained local log. `xr audit verify` detects any modification.
Read the security model.
XR is not certified by any third party and does not claim to be. What it does have is a documented threat model, an in-process policy gate, and a hash-chained audit log — all of which you can read in the repository.
XR enforces in-process policy, not kernel or VM isolation. Treat it as a strong guard rail, not a sandbox boundary.
Read SECURITY.md