draft
A printed research paper on a desk

Security

Security

Local-first by default, keyless, with releases and provenance you can check.

Posture

  • Local-first. The reader, claim gate, house-style checks and provenance are deterministic Go and never touch the network. Run fully offline with --engine ollama.
  • No API keys. draft drives agent CLIs through their own logged-in sessions. It stores no credentials and asks for none. (An opt-in --engine api:<provider> escape hatch reads your own key from the environment for machines with no agent CLI; it is never the default.)
  • No telemetry. draft has no servers and phones nothing home.
  • Provenance you can verify — and sign. Every article ships a C2PA manifest and a per-sentence attribution file; draft --verify recomputes the digests. With a signing certificate configured (DRAFT_C2PA_CERT / DRAFT_C2PA_KEY, c2patool installed) draft also emits a signed, detached .c2pa credential bound to the article, and --verify validates its signature and trust chain.
  • A verification record you can carry. draft --verify --json emits a portable draft.verification-record/v1 — the article digest and whether it matches, the grounding summary, the signature state, and the verdict — so any tool or pipeline can re-check an article's provenance without the CLI.

Data flow

With a local model, nothing leaves your machine. With a cloud agent CLI, the source excerpts draft needs to extract and write pass through that tool under your own session — the same data you would send by using that CLI directly.

For how draft's provenance maps to AI-disclosure rules, see provenance & compliance.

Supply-chain provenance

Every release is built by a GitHub Actions workflow on a GitHub-hosted runner and carries signed SLSA build provenance — a non-forgeable record of which workflow, at which commit, produced each artefact. Our target is SLSA v1.0 Build Level 3: provenance generated by a trusted builder isolated from the build, signed keylessly through Sigstore (a Fulcio certificate and the Rekor transparency log) with no long-lived key to leak.

What each release ships:

  • A build-provenance attestation for every archive (.tar.gz, .zip) and the macOS installer (.pkg), via actions/attest-build-provenance.
  • A cosign signature over checksums.txt (checksums.txt.sigstore.json), so the checksum manifest itself is verifiable, not merely trusted.
  • Apple code-signing and notarisation for the macOS binary and a Developer ID-signed installer.

Verify it yourself

Verify the provenance of a downloaded artefact with the GitHub CLI. It checks the Sigstore signature and that the attestation came from this repository's release workflow:

gh attestation verify draft_<version>_darwin_arm64.tar.gz \
  --repo sebastienrousseau/draft

The same command verifies the installer:

gh attestation verify draft-<version>.pkg --repo sebastienrousseau/draft

Verify the signed checksum manifest with cosign. The identity regexp pins the signature to this repository's release workflow, so a manifest signed by anything else fails:

cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp \
    'https://github.com/sebastienrousseau/draft/.github/workflows/release.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt

Then confirm your download against the verified manifest:

shasum -a 256 --check checksums.txt --ignore-missing

This verifies the release — that the binary you ran was built by us and not tampered with. It is separate from, and complementary to, the per-article provenance draft emits for the documents it writes.

Reporting a vulnerability

Please report security issues privately through the GitHub security advisories page rather than a public issue.