Terms of Service

01. Agreement & Acceptance

By downloading, building, installing, executing, or accessing SecretHarbor (including the shb CLI, kernel sandboxing profiles, transparent shims, and source code) or by utilizing the website at secretharbor.dev, you enter into a binding agreement governed by these Terms of Service and the Apache License, Version 2.0.

If you do not agree to these terms, do not install, execute, or utilize SecretHarbor.

02. Apache 2.0 Open Source License Grant

SecretHarbor source code is licensed under the Apache License, Version 2.0 (the "License"). You may obtain a copy of the License at:

https://www.apache.org/licenses/LICENSE-2.0

Under the License, subject to its terms and conditions:

• Copyright Grant: Each contributor grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute the work and derivative works in source or object form.
• Patent Grant: Each contributor grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the work.
• Redistribution Conditions: You may copy and distribute copies of the work in any medium, provided that you give any other recipients a copy of the License, retain all copyright, patent, and trademark notices, and provide prominent notice of any modifications made.

03. Security Boundary Disclaimers & Defense-in-Depth

SecretHarbor is an engineering tool designed to enforce a host-level operating system boundary beneath AI coding agents (such as Claude Code, Cursor, Codex, Google Antigravity, OpenCode, Kiro, etc.) by virtualizing sensitive files, sanitizing environment variables, and gating capability requests.

You explicitly acknowledge and agree to the following security realities:

• Defense-in-Depth Tooling: SecretHarbor is a defense-in-depth mitigation layer, not a replacement for comprehensive application security practices. No automated software sandboxing boundary can guarantee 100% invulnerability against every theoretical threat.
• Zero-Day & Kernel Exploit Scope: If an underlying host operating system kernel experiences an unpatched local privilege escalation (LPE) or zero-day vulnerability, sandboxing primitives (such as Apple Seatbelt or Linux user namespaces) could potentially be compromised.
• Explicit Disablement (shb guard off): The CLI provides deliberate override switches. When an operator runs shb guard off or explicitly marks resources as unconfined, SecretHarbor ceases boundary enforcement for that scope. The user bears sole responsibility for the consequences of intentional policy exemptions.
• Adversarial Verification (shb doctor): Users are encouraged to run shb doctor to inspect active vectors and understand platform-specific sandboxing capabilities and limitations on their current hardware.
• Developer Hygiene: You remain solely responsible for backing up project repositories, maintaining git clean states, rotating production API credentials, and exercising caution before allowing untrusted agentic tasks to run destructive terminal operations.

04. Platform Support & Capability Tiers

SecretHarbor implements distinct operating system drivers depending on the host platform:

• Tier 1 — Production Ready (macOS): Apple Seatbelt (sandbox-exec / libsandbox) kernel isolation, Close-on-Exec descriptor stripping, and shadow filesystem virtualization.
• Tier 1 — Production Ready (Linux): Unprivileged user namespaces (CLONE_NEWUSER, CLONE_NEWNS, CLONE_NEWIPC), mount isolation, and process dump prevention (PR_SET_DUMPABLE=0).
• Tier 2 — Developer Preview (Windows): Process group job objects and environment sanitization. Windows environments are in active development and may have narrower isolation guarantees than Tier 1 platforms.

05. Permitted Use & Responsible Development

You agree to use SecretHarbor solely for lawful software development, testing, research, and defensive security workflows. Specifically:

• Permitted Uses: Running AI coding agents in sandboxed environments, automating local build workflows, evaluating agent capabilities, protecting workstation secrets, and conducting authorized security research on systems you own or have permission to test.
• Prohibited Uses: Deploying SecretHarbor to obfuscate malicious payloads, execute unauthorized offensive intrusions, bypass authorized enterprise endpoint monitoring without permission, or violate intellectual property rights.

06. Synthetic Secrets & Format-Preserving Virtualization

SecretHarbor synthesizes fake format-preserving credentials (such as synthetic API tokens and dummy database connection strings) to satisfy agent syntax parsers and unit tests without exposing authentic credentials.

• Synthetic secrets are non-functional placeholder strings generated locally in memory. They cannot authenticate against real external services.
• If an agent attempts to initiate live outbound API calls using synthetic credentials, the upstream service will predictably reject the connection. This behavior is deliberate and intended.
• You are solely responsible for ensuring that authentic credentials stored in your local encrypted vault (~/.secretharbor/vault.enc) are properly managed and backed up.

07. Disclaimer of Warranties

IN ACCORDANCE WITH SECTION 7 OF THE APACHE 2.0 LICENSE:

UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING, LICENSOR PROVIDES THE WORK (AND EACH CONTRIBUTOR PROVIDES ITS CONTRIBUTIONS) ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY, OR FITNESS FOR A PARTICULAR PURPOSE. YOU ARE SOLELY RESPONSIBLE FOR DETERMINING THE APPROPRIATENESS OF USING OR REDISTRIBUTING THE WORK AND ASSUME ANY RISKS ASSOCIATED WITH YOUR EXERCISE OF PERMISSIONS UNDER THIS LICENSE.

08. Limitation of Liability

IN ACCORDANCE WITH SECTION 8 OF THE APACHE 2.0 LICENSE:

IN NO EVENT AND UNDER NO LEGAL THEORY, WHETHER IN TORT (INCLUDING NEGLIGENCE), CONTRACT, OR OTHERWISE, UNLESS REQUIRED BY APPLICABLE LAW (SUCH AS DELIBERATE AND GROSSLY NEGLIGENT ACTS) OR AGREED TO IN WRITING, SHALL ANY CONTRIBUTOR BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER ARISING AS A RESULT OF THIS LICENSE OR OUT OF THE USE OR INABILITY TO USE THE WORK (INCLUDING BUT NOT LIMITED TO DAMAGES FOR LOSS OF GOODWILL, WORK STOPPAGE, COMPUTER FAILURE OR MALFUNCTION, DATA LOSS, COMPROMISED SECRETS, OR ANY AND ALL OTHER COMMERCIAL DAMAGES OR LOSSES), EVEN IF SUCH CONTRIBUTOR HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

09. High-Risk & Critical Environments

SecretHarbor is not fault-tolerant and is not designed, manufactured, or intended for use in high-risk, fail-safe environments requiring fail-safe performance (such as the operation of nuclear facilities, aircraft navigation or communication systems, air traffic control, life support machines, or weapons systems) where the failure of software could lead directly to death, personal injury, or severe physical or environmental damage.

10. Trademarks & Brand Usage

The Apache 2.0 License does not grant trademark rights. "SecretHarbor", the SecretHarbor shield and harbor sigil, and associated logos are trademarks of the project maintainers.

You may not use project trademarks in any manner that implies endorsement, affiliation, or sponsorship of any fork, modified distribution, or commercial service without explicit written consent.

11. Website Properties (secretharbor.dev)

The marketing website located at secretharbor.dev is provided for informational and distribution purposes:

• The website is provided "AS IS" and may experience scheduled maintenance or outages.
• You agree not to engage in denial-of-service attacks, automated scraping that degrades service availability, or vulnerability probing against our hosting edge.

12. Termination & Severability

Any rights granted under the Apache 2.0 License terminate automatically if you initiate patent litigation against any contributor alleging that the software infringes your patents.

If any provision of these Terms is found to be unlawful, void, or unenforceable, that provision will be deemed severable and will not affect the validity and enforceability of any remaining provisions.

13. Changes to These Terms

We may update these Terms of Service periodically to reflect changes in our software, legal requirements, or community governance. All revisions will be posted to this page with an updated Effective Date. Continued use of SecretHarbor constitutes acceptance of modified terms.

14. Contact & Inquiries

For legal inquiries, trademark licensing, or governance questions, please contact:

mail@secretharbor.dev