12 lines
291 B
Markdown
12 lines
291 B
Markdown
# Security Policies
|
|
|
|
Command safety is enforced before process execution.
|
|
|
|
Modes:
|
|
|
|
- `WARN`: allow unknown binary and log warning.
|
|
- `BLOCK`: reject unknown binary.
|
|
- `ALLOW`: skip safe-registry checks.
|
|
|
|
Safe registry defaults include common package-manager executables and is configurable.
|