# Security.

Defensive work on the repository owner's code. Security work needs activation for your Pro or Enterprise workspace. Once active, choose it for each repository.

## What it looks for

A security flaw lets an untrusted actor cross a boundary the code must enforce. Examples include input treated as a command, a request accepted from the wrong origin, missing authorization and exposed secrets. Perfloop also looks for untrusted input that escapes resource limits or breaks memory safety. The contract must come from the project's requirements, not an assumption that every unusual input is forbidden.

## How it proves a change

A Case states the security contract. The smallest test that shows its violation must fail on the original code and pass after the repair. The repository's checks must pass, and an independent verifier checks the change and its proof. Perfloop does not build or publish exploits.

## What you receive

On a private repo, a proven change follows the normal approval path to a pull request, or an issue when that is the appropriate contribution. The Case keeps the patch and proof. Perfloop cannot approve, merge or deploy.

## Public repos stay private until fixed

Keep a security finding private until the maintainer publishes the fix. A security Case is never shown anonymously. Public reviews omit security findings, and public publication starts held. You can download the patch and proof from the member-only Case and deliver them to the maintainer privately. Perfloop does not open a private security advisory for you.

## Limits

This is work on code you have connected and selected, not permission to attack another system. A proven repair covers its stated contract and tested conditions; it is not a security certification or a promise that the repository has no other flaws. Work follows your repository settings, Usage and Case limits.

The [loop reference](https://perfloop.ai/docs/work) explains proof and publication. For how Perfloop handles your data and access, read [Perfloop security](https://perfloop.ai/security).

Also in this section: [Quickstart](https://perfloop.ai/docs/work/quickstart), [Performance](https://perfloop.ai/docs/work/performance), [Bugs](https://perfloop.ai/docs/work/bugs), [The loop](https://perfloop.ai/docs/work), [Case states](https://perfloop.ai/docs/work/states), [Pull requests](https://perfloop.ai/docs/work/pull-requests), [Steering and learning](https://perfloop.ai/docs/work/steering), [Initiatives](https://perfloop.ai/docs/work/initiatives), [Autonomy and limits](https://perfloop.ai/docs/work/autonomy), [Members](https://perfloop.ai/docs/work/members), and [The MCP server](https://perfloop.ai/docs/work/mcp).