diff --git a/SECURITY.md b/SECURITY.md index a08255046e3..95045cf7a38 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -17,74 +17,79 @@ We take the security of Eliza seriously. If you believe you have found a securit 1. **DO NOT** create a public GitHub issue for the vulnerability 2. Send an email to security@eliza.builders with: - - A detailed description of the vulnerability - - Steps to reproduce the issue - - Potential impact of the vulnerability - - Any possible mitigations you've identified + - A detailed description of the vulnerability + - Steps to reproduce the issue + - Potential impact of the vulnerability + - Any possible mitigations you've identified ### What to Expect -- **Initial Response**: Within 48 hours, you will receive an acknowledgment of your report -- **Updates**: We will provide updates every 5 business days about the progress -- **Resolution Timeline**: We aim to resolve critical issues within 15 days -- **Disclosure**: We will coordinate with you on the public disclosure timing +- **Initial Response**: Within 48 hours, you will receive an acknowledgment of your report +- **Updates**: We will provide updates every 5 business days about the progress +- **Resolution Timeline**: We aim to resolve critical issues within 15 days +- **Disclosure**: We will coordinate with you on the public disclosure timing ## Security Best Practices ### For Contributors 1. **API Keys and Secrets** - - Never commit API keys, passwords, or other secrets to the repository - - Use environment variables as described in our secrets management guide - - Rotate any accidentally exposed credentials immediately + + - Never commit API keys, passwords, or other secrets to the repository + - Use environment variables as described in our secrets management guide + - Rotate any accidentally exposed credentials immediately 2. **Dependencies** - - Keep all dependencies up to date - - Review security advisories for dependencies regularly - - Use `pnpm audit` to check for known vulnerabilities + + - Keep all dependencies up to date + - Review security advisories for dependencies regularly + - Use `pnpm audit` to check for known vulnerabilities 3. **Code Review** - - All code changes must go through pull request review - - Security-sensitive changes require additional review - - Enable branch protection on main branches + - All code changes must go through pull request review + - Security-sensitive changes require additional review + - Enable branch protection on main branches ### For Users 1. **Environment Setup** - - Follow our [secrets management guide](docs/guides/secrets-management.md) for secure configuration - - Use separate API keys for development and production - - Regularly rotate credentials + + - Follow our [secrets management guide](docs/guides/secrets-management.md) for secure configuration + - Use separate API keys for development and production + - Regularly rotate credentials 2. **Model Provider Security** - - Use appropriate rate limiting for API calls - - Monitor usage patterns for unusual activity - - Implement proper authentication for exposed endpoints + + - Use appropriate rate limiting for API calls + - Monitor usage patterns for unusual activity + - Implement proper authentication for exposed endpoints 3. **Platform Integration** - - Use separate bot tokens for different environments - - Implement proper permission scoping for platform APIs - - Regular audit of platform access and permissions + - Use separate bot tokens for different environments + - Implement proper permission scoping for platform APIs + - Regular audit of platform access and permissions ## Security Features ### Current Implementation -- Environment variable based secrets management -- Type-safe API implementations -- Automated dependency updates via Renovate -- Continuous Integration security checks +- Environment variable based secrets management +- Type-safe API implementations +- Automated dependency updates via Renovate +- Continuous Integration security checks ### Planned Improvements 1. **Q4 2024** - - Automated security scanning in CI pipeline - - Enhanced rate limiting implementation - - Improved audit logging + + - Automated security scanning in CI pipeline + - Enhanced rate limiting implementation + - Improved audit logging 2. **Q1 2025** - - Security-focused documentation improvements - - Enhanced platform permission management - - Automated vulnerability scanning + - Security-focused documentation improvements + - Enhanced platform permission management + - Automated vulnerability scanning ## Vulnerability Disclosure Policy @@ -100,21 +105,21 @@ We follow a coordinated disclosure process: We believe in recognizing security researchers who help improve our security. Contributors who report valid security issues will be: -- Credited in our security acknowledgments (unless they wish to remain anonymous) -- Added to our security hall of fame -- Considered for our bug bounty program (coming soon) +- Credited in our security acknowledgments (unless they wish to remain anonymous) +- Added to our security hall of fame +- Considered for our bug bounty program (coming soon) ## License Considerations As an MIT licensed project, users should understand: -- The software is provided "as is" -- No warranty is provided -- Users are responsible for their own security implementations -- Contributors grant perpetual license to their contributions +- The software is provided "as is" +- No warranty is provided +- Users are responsible for their own security implementations +- Contributors grant perpetual license to their contributions ## Contact -- Security Issues: security@eliza.builders -- General Questions: Join our [Discord](https://discord.gg/ai16z) -- Updates: Follow our [security advisory page](https://github.com/ai16z/eliza/security/advisories) +- Security Issues: security@eliza.builders +- General Questions: Join our [Discord](https://discord.gg/ai16z) +- Updates: Follow our [security advisory page](https://github.com/ai16z/eliza/security/advisories) diff --git a/packages/plugin-node/src/services/llama.ts b/packages/plugin-node/src/services/llama.ts index 720972278f3..d4982e6bc6d 100644 --- a/packages/plugin-node/src/services/llama.ts +++ b/packages/plugin-node/src/services/llama.ts @@ -486,9 +486,32 @@ export class LlamaService extends Service { throw new Error("Model not initialized. Call initialize() first."); } - const embeddingContext = await this.model.createEmbeddingContext(); - const embedding = await embeddingContext.getEmbeddingFor(input); - return embedding?.vector ? [...embedding.vector] : undefined; + const ollamaModel = process.env.OLLAMA_MODEL; + const ollamaUrl = + process.env.OLLAMA_SERVER_URL || "http://localhost:11434"; + const embeddingModel = + process.env.OLLAMA_EMBEDDING_MODEL || "mxbai-embed-large"; + elizaLogger.info( + `Using Ollama API for embeddings with model ${embeddingModel} (base: ${ollamaModel})` + ); + + const response = await fetch(`${ollamaUrl}/api/embeddings`, { + method: "POST", + headers: { + "Content-Type": "application/json", + }, + body: JSON.stringify({ + input: input, + model: embeddingModel, + }), + }); + + if (!response.ok) { + throw new Error(`Failed to get embedding: ${response.statusText}`); + } + + const embedding = await response.json(); + return embedding.vector; } }