# Security

## Purpose

Teddy treats AI actions as privileged automation. Every mutating tool must go
through approval, capability checks, and audit logging before GA.

## Automated audit

- Service: `src/Application/UseCase/SecurityAuditService.php`
- Admin: **Teddy → Security** (requires `use_agent_pipeline`)
- REST: `GET /teddy/v1/security/audit`

Checks cover (docs 02/03 §12):

- Tool capability declared
- Dotted / namespaced tool names
- Dangerous tools have dry-run/preview
- Rate limit configured
- Feature flags default off for beta surfaces
- No `eval` / dynamic code in Teddy sources
- No secret-looking settings keys
- SQL uses `$wpdb->prepare`
- REST mutations not publicly writable

## Hard rules

1. Dangerous tools (`is_dangerous() === true`) never execute without `approved`
2. Extension tools cannot bypass `ToolExecutor`
3. Public chatbot stays read-only tools only
4. Resolve every Critical/High finding before release

## Verification

```bash
php tests/e2e-security.php   # Laragon PHP 8.2+
composer test:integration    # SecurityAuditServiceTest
```