Dulus takes security seriously. This document outlines our security practices, reporting procedures, and responsible disclosure policy.

Dulus operates with a tiered permission system:

• API-key fields stored in ~/.dulus/config.json are obfuscated with XOR + base64.
• Set DULUS_SECRET to replace the built-in compatibility key.
• Environment variable bridging does not overwrite variables that are already present.
• Secrets are redacted from configuration and diagnostic output where those paths are handled.
• Keys can be rotated with /config <provider>_api_key=new_key.

This storage format is not cryptographic secret storage. It prevents casual plaintext disclosure but does not protect against an attacker who can read the configuration and application source. Use operating-system permissions, full-disk encryption, short-lived credentials, or a separate secret manager for stronger protection.

• Bash whitelist: Safe commands (ls, cat, grep) auto-approve in auto mode
• Mutation gate: File writes and shell commands outside the safe-command set request approval unless accept-all is active
• Plan mode: Blocks mutating tools while preserving a writable plan artifact
• Auditability: Tool requests and results remain visible in the active session
• Worktree isolation: Sub-agents can work in separate git worktrees to reduce accidental overlap

• Dulus runs locally and stores its sessions, tasks, and memory on the machine.
• Prompts and tool context are sent to the provider you select unless you use a local model.
• Plugins, MCP servers, browser-backed providers, search tools, and bridges may contact their own services; review them before enabling them.
• Memory stays under ~/.dulus/memory/ and project-local .dulus/memory/ unless a configured integration moves that data.
• Telemetry is opt-in. When enabled, operational events exclude prompts, responses, file contents, paths, credentials, emails, and usernames.

If you discover a security vulnerability in Dulus, please report it responsibly:

1. Do NOT open a public issue
2. Send an email to: security@dulus.ai
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

We follow responsible disclosure:

1. Reporter submits vulnerability privately
2. We acknowledge and assess
3. We develop and test a fix
4. Fix is released
5. Public disclosure with credit to reporter

We publicly credit security researchers who report valid vulnerabilities (with their permission).

/permissions auto        # Default — safe for daily use
/permissions manual      # When working with sensitive data
/plan                    # Enter read-only planning mode

chmod 700 ~/.dulus

export DULUS_SECRET="your-random-secret-here"

pip install --upgrade dulus

Only install plugins from trusted sources:

/plugin install trusted-plugin@https://github.com/trusted-org/repo

Review .mcp.json before connecting:

cat ~/.dulus/mcp.json

/config tts_enabled=false

1. Config obfuscation is reversible. Use operating-system or external secret storage for strong protection.
2. Browser-backed providers manage session cookies or tokens. Use them only on trusted machines and rotate sessions after suspected exposure.
3. accept-all removes the approval boundary. Do not use it with sensitive data or on an untrusted checkout.
4. Third-party code runs with your user permissions. Review plugins, skills, MCP servers, hooks, and generated adapters before enabling them.
5. Sub-agents are not a security boundary. Worktrees isolate files, not operating-system privileges.

Security is not a feature — it is a foundation. We keep flying, securely.