primr is an LLM-API client + adaptive web scraper + MCP/A2A agent. It does not train, fine-tune, host, or serve models - the models are third-party hosted APIs (Gemini, Grok, OpenAI, Anthropic, Ollama). Per primr's design philosophy, the model is a commodity; the orchestration pipeline is the asset.

That framing scopes the threat model. Whole categories of adversarial-ML security are out of scope by construction because primr owns no model weights or training pipeline: training-time poisoning/backdoors, model extraction/stealing, membership/attribute inference, model inversion, watermarking/weight protection, and confidential-compute/certified-robustness serving. If primr ever ships a hosted/served model, this section must be revisited.

The real attack surface is four things: (1) untrusted retrieved content flowing into prompts, (2) LLM output driving downstream actions, (3) the agentic MCP/A2A tool surfaces, and (4) provider secrets + the dependency supply chain.

• T1 is mitigated, not eliminated - a novel phrasing could evade the pattern set; the data-fence is the backstop, and an injection red-team eval is tracked.
• T1 laundered injection: LLM-generated working artifacts (gap analysis, the analysis workbook) are built FROM fenced scraped inputs but enter later prompts unfenced; an injection that survives into the model's own output re-enters downstream prompts as trusted text. Accepted because re-fencing model output would fence the pipeline's own analysis, and the upstream fences plus sanitization make survival unlikely; the red-team eval covers this path.
• T2 has complete pre-request SSRF validation and per-hop redirect validation on the shared safe HTTP seam, async citation HEAD requests, preflight website HEAD checks, provider-hosted skill-pack image fetches, discovery HTTP helpers, pooled HTTPClient GET/HEAD calls, and the tiered requests/httpx/curl_cffi scrapers. Workday hiring-signal JSON POST probes now drop redirects rather than following an unvalidated hop. The shared safe HTTP seam, tiered httpx scraper, pooled HTTPClient, tiered requests scraper, and curl_cffi scraper now resolve each hop once, validate every returned address, and pin the actual connection target while preserving the public hostname semantics each client needs for virtual hosting and TLS. Browser-backed Chromium tiers now pin the initial hostname with Chromium resolver rules and force browser traffic through a local loopback egress proxy. The proxy validates each HTTP request or HTTPS CONNECT target, dials the validated IP literal, and tunnels TLS without terminating it, while Playwright-compatible route guards remain as defense-in-depth. QUIC is disabled for proxied browser launches so browser traffic stays on the TCP proxy path.
• T8 Stages 1-3 are shipped for MCP tool dispatch and resource reads: per-tool scopes, server-issued approval tokens, and structured audit events. The first seven job-scoped artifact-resource slices are also shipped: primr://output/artifacts/by_job/{job_id} returns metadata only for an owned job, and primr://output/qa_summary/by_job/{job_id} returns compact QA score/status/count metadata without detailed QA body text, and primr://output/usage_summary/by_job/{job_id} returns compact manifest cost, timing, approval, execution, and artifact-count metadata without company URLs, approval tokens, manifest artifact lists, or full manifest content, and primr://output/source_summary/by_job/{job_id} returns compact citation/source appendix metadata without report body content, and primr://output/trace_summary/by_job/{job_id} returns compact scrape trace metadata without URLs, final URLs, raw trace entries, or page content, and primr://output/verification_summary/by_job/{job_id} returns compact claim verification trust score, claim counts, status counts, first-party downgrade counts, and source-reference counts without raw claims, source URLs, search queries, explanations, or report body content, and primr://output/calibration_summary/by_job/{job_id} returns compact label-calibration per-label counts, inference source-copy counts, evidence-review count buckets, judge provenance, and judge-agreement metadata without raw claims, source URLs, evidence reviews, rationales, or report body content. MCP report-body reads now use primr://output/report/by_job/{job_id} with ownership checks, explicit report scope for authenticated HTTP callers, and content_mode / artifact_type / max_chars output negotiation. check_jobs, primr://output/latest, and primr://output/by_job/{job_id} omit report bodies or previews for all authenticated HTTP callers, even when they hold report; A2A check_jobs returns compact artifact/report resource URIs instead of raw output paths. All hide unowned jobs behind the same response as missing jobs. Resource-read audit events record normalized resource kind, hashed URI, hashed result body, job id when present, granted scopes, request id, span-safe attributes, duration, and outcome without raw URI query values, raw resource bodies, or raw caller ids. A2A authenticated requests now share the MCP auth context, enforce read/research at skill dispatch, own jobs by token client_id, enforce report for read_report_by_job, and write skill-call audit events with hashed message/result payloads, hashed caller ids, granted scopes, request id, span-safe attributes, duration, outcome, and job id when present. A2A estimate_research now issues approval-token fields, and A2A research_company enforces max_estimated_cost_usd plus a matching token when cost-cap enforcement is active before job creation, then propagates the accepted cap into PipelineRunner as the runtime budget. Residual risk remains around required provider tasks that cannot be interrupted mid-flight after the user accepts the estimate. Issue low-trust tokens with explicit read scopes rather than relying on legacy no-scope JWT defaults, and issue report only to clients that should consume report text.
• Chat logs and reports are persisted locally; protect logs/ and working dirs with normal filesystem permissions.

Requires Python 3.12+ (3.10/3.11 are past or nearing end-of-life).

If you discover a security vulnerability in Primr, please report it responsibly.

Do NOT open a public GitHub issue for security vulnerabilities.

1. Email security concerns to the maintainers (see GitHub profile for contact)
2. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Any suggested fixes (optional)

• Acknowledgment within 48 hours
• Status update within 7 days
• Fix timeline depends on severity:
  • Critical: 24-48 hours
  • High: 7 days
  • Medium: 30 days
  • Low: Next release

Security issues we care about:

• SSRF vulnerabilities
• Authentication/authorization bypasses
• Injection attacks (SQL, command, template)
• Path traversal
• Sensitive data exposure
• Denial of service

Out of scope:

• Rate limiting effectiveness (configurable by deployment)
• Issues requiring physical access
• Social engineering

Primr implements several security controls:

• SSRF Protection: All outbound URLs are validated against private IP ranges, cloud metadata endpoints, and DNS rebinding; migrated helpers also validate every redirect hop before connecting, the shared safe HTTP, requests-family, httpx scraper, and curl_cffi scraper seams pin connections to the validated address, and Chromium-backed browser tiers force browser traffic through the local pinned egress proxy while route-guarding unsafe requests where supported
• Input Sanitization: Company names and URLs sanitized against injection attacks
• JWT Authentication: Signed token verification for MCP HTTP mode
• Rate Limiting: Per-client request limits
• Security Headers: OWASP-recommended headers on all API responses

See SECURITY_OPS.md for operational security guidance.

• January 2026: Initial security review (XXE, SSRF fixes)
• February 2026: JWT verification, CORS hardening, input sanitization
• May 2026: AI/agent security posture - indirect prompt-injection fencing (fence_untrusted) at the insights-extraction, deep-research, and composer boundaries, sink-level secret redaction (SecretMaskingFilter) + chat-log redaction, egress-guardrail invariant tests across all fetch helpers, supply-chain gates (pip-audit, bandit, Dependabot, SLSA provenance), and this scoped threat model.
• July 2026: fencing extended to the remaining fast-run scraped-text→prompt boundaries (workbook/section corpus blocks, hypothesis tree, gap-analysis summaries, regeneration evidence, hiring triage/extraction, insights.txt external block, strategy context artifacts); the T1 row now enumerates fenced vs sanitize-only boundaries instead of claiming blanket coverage.

We appreciate responsible disclosure and will acknowledge security researchers who report valid vulnerabilities (with permission).