GPR-011 · critical risk
Review SSH key reads
Require review before supported file-read surfaces access a common SSH private-key path.
Decision
review
Matcher
path = .ssh/id_rsa
Reviewed
2026-08-09
Safe test cases
matching synthetic case
path = .ssh/id_rsa → review
different benign synthetic case
path = benign-.ssh/id_rsa → unmatched
Limitations
- Other key names and credential stores require separate review or policy coverage.
Review before applying
This recipe is a starting point, not a universal security policy. Open it in Policy Studio, replace example identifiers where necessary, review scope and blast radius, simulate where supported, and use the normal approval flow before enforcement.
Recipe SHA-256: 317327768e3502c28b7ea3014b4030b79d85c2066126b0fb4b20a47b927a1293
When a policy is saved and delivered through Guard Cloud, it uses the existing Guard policy-bundle compiler. If the policy-bundle signing key is configured, that compiler produces an RSA-PSS-SHA256 signed bundle that local Guard verifies before applying.