safe_bro 0.1.0

data/app/views/safe_bro/rules/show.html.erb

@@ -0,0 +1,53 @@
+<% bro_hub_crumb "Rules" %>
+<% protected_now = @config.enabled? %>
+<%= bro_hub_hero eyebrow: "Effective configuration · read only", title: "Rules", subtitle: (protected_now ? "active here" : "off here"),
+      tone: (protected_now ? :green : :muted),
+      lead: "What SafeBro locks, blocks and flags right now. Change it in config/initializers/safe_bro.rb." %>
+
+<% tags = ->(values, tone = nil) {
+     values.any? ? tag.div(safe_join(values.map { |value| tag.span(safe_bro_rule(value), class: [ "bh-tag", tone ].compact.join(" "), style: "text-transform:none") }, " "), class: "bh-tags") : tag.span("none", class: "bh-cell-muted")
+   } %>
+
+<div class="bh-split">
+  <section class="bh-split-main">
+    <h2 class="bh-h2">Locked until <code>unlock!</code></h2>
+    <dl class="bh-dl">
+      <dt>Resources</dt><dd><%= tags.call(@config.protected_resources, "is-amber") %></dd>
+      <dt>ENV names</dt><dd><%= tags.call(@config.protected_env_patterns) %></dd>
+      <dt>Files</dt><dd><%= tags.call(@config.protected_file_patterns) %></dd>
+      <dt>Systems</dt><dd><%= tags.call(@protected_hosts) %></dd>
+    </dl>
+
+    <h2 class="bh-h2" style="margin-top:36px">Blocked before it runs</h2>
+    <dl class="bh-dl">
+      <dt>Can't reopen</dt><dd><%= tags.call(@config.forbidden_reopening, "is-red") %></dd>
+      <dt>Never referenced</dt><dd><%= tags.call(Array(@config.forbidden_constants[:always]), "is-red") %></dd>
+      <dt>While locked</dt><dd><%= tags.call(Array(@config.forbidden_constants[:locked]), "is-red") %></dd>
+      <dt>Can't be called</dt><dd><%= tags.call(@config.forbidden_methods, "is-red") %></dd>
+    </dl>
+
+    <h2 class="bh-h2" style="margin-top:36px">Flagged when mentioned</h2>
+    <%= tags.call(@config.suspicious_terms, "is-amber") %>
+  </section>
+
+  <div class="bh-split-aside">
+    <section class="bh-block">
+      <h2 class="bh-h2">Where it runs</h2>
+      <dl class="bh-dl">
+        <dt>Environments</dt><dd><%= @config.protected_environments.join(", ") %></dd>
+        <dt>Forced</dt><dd><%= @config.enabled.nil? ? "no" : @config.enabled ? "on" : "off" %></dd>
+        <dt>Runners</dt><dd><%= @config.audit_runner ? "recorded" : "not recorded" %></dd>
+        <dt>Ask for a name</dt><dd><%= @config.ask_for_username_if_empty ? "yes" : "no, console refuses to start" %></dd>
+      </dl>
+    </section>
+    <section class="bh-block">
+      <h2 class="bh-h2">Review</h2>
+      <dl class="bh-dl">
+        <dt>Keep sessions</dt><dd><%= @config.retention ? distance_of_time_in_words(@config.retention) : "forever" %></dd>
+        <dt>Keep flagged</dt><dd><%= @config.keep_flagged ? "yes, even past that" : "no" %></dd>
+        <dt>Self review</dt><dd><%= @config.allow_self_audit ? "allowed" : "not allowed" %></dd>
+        <dt>Require SSL</dt><dd><%= @config.require_ssl ? "yes" : "no" %></dd>
+      </dl>
+    </section>
+  </div>
+</div>

data/app/views/safe_bro/sessions/index.html.erb

@@ -0,0 +1,51 @@
+<% status = @filter[:status] || "all" %>
+<% bro_hub_crumb "Console sessions" %>
+<% content_for :bro_hub_crumb_actions do %>
+  <% [ [ "Pending", "pending" ], [ "Appropriate", "approved" ], [ "Flagged", "flagged" ], [ "All", "all" ] ].each do |label, value| %>
+    <%= bro_hub_crumb_link label, root_path(@filter.merge(status: value)), active: status == value %>
+  <% end %>
+<% end %>
+
+<%= bro_hub_hero eyebrow: "Console sessions",
+      title: @total,
+      tone: { "approved" => :green, "flagged" => :red }[status],
+      subtitle: { "pending" => "awaiting a verdict", "approved" => "approved", "flagged" => "flagged" }.fetch(status, @total == 1 ? "session" : "sessions"),
+      lead: "Who used a console, why, and what they did. Review each one: approve it or flag it.",
+      stats: [ [ @unlock_total, "unlocks", :amber ], [ @flag_total, "flagged commands", :red ] ] %>
+
+<%= form_with url: root_path, method: :get, class: "bh-filters" do %>
+  <%= hidden_field_tag :status, status %>
+  <%= text_field_tag :username, @filter[:username], placeholder: "Filter by user", class: "bh-input is-strong", "aria-label": "Filter by user" %>
+  <label class="bh-field">From <%= date_field_tag :from, @filter[:from], class: "bh-input" %></label>
+  <label class="bh-field">To <%= date_field_tag :to, @filter[:to], class: "bh-input" %></label>
+  <% attention = @filter[:attention] == "1" %>
+  <%= link_to "Needs attention only", root_path(@filter.merge(status: status, attention: (attention ? nil : "1"))),
+        class: [ "bh-chip", ("is-on" if attention) ], title: "Unlocked sensitive data or flagged commands" %>
+  <%= hidden_field_tag :attention, "1" if attention %>
+  <%= submit_tag "Filter", name: nil, class: "bh-chip" %>
+  <%= link_to "Reset", root_path(status: status), class: "bh-link-quiet" %>
+<% end %>
+
+<div class="bh-table-wrap">
+  <div class="bh-table" style="--cols: 150px 120px minmax(220px,1fr) 80px 64px 200px 110px; --min: 920px">
+    <div class="bh-row is-head"><span>Started</span><span>User</span><span>Reason</span><span>Source</span><span>Length</span><span>Flags</span><span>Review</span></div>
+    <% @sessions.each do |session| %>
+      <% unlocked = @unlock_counts.fetch(session.id, 0) %>
+      <% flagged = @flag_counts.fetch(session.id, 0) %>
+      <%= link_to session_path(session, @filter), class: [ "bh-row", ("bh-edge-red" if flagged > 0), ("bh-edge-amber" if flagged.zero? && unlocked > 0) ] do %>
+        <span class="bh-tone-violet"><%= safe_bro_time(session.started_at) %></span>
+        <span class="bh-cell-strong"><%= session.username %></span>
+        <span class="bh-cell-text"><%= truncate(session.reason, length: 90) %></span>
+        <span class="bh-cell-muted"><%= session.source %></span>
+        <span><%= safe_bro_duration(session.duration) %><%= " (open)" if session.open? %></span>
+        <span class="bh-tags">
+          <%= content_tag(:span, safe_bro_count(unlocked, "unlock"), class: "bh-tag is-amber") if unlocked > 0 %>
+          <%= content_tag(:span, "#{flagged} flagged", class: "bh-tag is-red") if flagged > 0 %>
+        </span>
+        <%= review_status_text(session.review_status) %>
+      <% end %>
+    <% end %>
+    <% if @sessions.empty? %><div class="bh-empty">Nothing to review.</div><% end %>
+    <%= safe_bro_pager total: @total, page: @page, noun: "session" %>
+  </div>
+</div>

data/app/views/safe_bro/sessions/show.html.erb

@@ -0,0 +1,91 @@
+<% bro_hub_crumb "Console sessions", "##{@session.id}" %>
+<% content_for :bro_hub_crumb_actions do %>
+  <%= bro_hub_crumb_link "← All sessions", root_path(filter_params) %>
+<% end %>
+
+<% flagged_count = @commands.count(&:flagged?) %>
+<%= bro_hub_hero eyebrow: "#{@session.source} · #{@session.hostname} (pid #{@session.pid})",
+      title: "Session ##{@session.id}",
+      subtitle: review_status_text(@session.review_status),
+      lead: safe_join([ content_tag(:strong, @session.username), " was on a console for #{safe_bro_duration(@session.duration)}. Reason given: “#{@session.reason}”" ]) %>
+
+<div class="bh-split">
+  <section class="bh-split-main">
+    <div class="bh-block-head">
+      <h2 class="bh-h2">What they ran</h2>
+      <span class="bh-meta"><%= safe_bro_count(@commands.size, "command") %> · <%= flagged_count %> flagged</span>
+    </div>
+
+    <div class="bh-log">
+      <% if @commands.empty? %><div class="bh-cmd"><div class="bh-cmd-meta"><span>Nothing was typed.</span></div></div><% end %>
+      <% previous_access = nil %>
+      <% @commands.each do |command| %>
+        <% if command.sensitive_access && command.sensitive_access != previous_access %>
+          <div class="bh-unlock">
+            <span style="text-transform:uppercase">Unlocked</span> (<%= command.sensitive_access.resources %>) at <%= safe_bro_time(command.sensitive_access.started_at) %>:
+            “<%= command.sensitive_access.justification %>”
+          </div>
+        <% elsif command.sensitive_access.nil? && previous_access %>
+          <div class="bh-cmd"><div class="bh-cmd-meta"><span>Locked again</span></div></div>
+        <% end %>
+        <% previous_access = command.sensitive_access %>
+        <div class="bh-cmd <%= "is-flagged is-#{command.status}" if command.flagged? %> <%= "is-unlocked" if command.sensitive_access && !command.flagged? %> <%= "is-sensitive" if command.sensitive_access %>">
+          <div class="bh-cmd-meta">
+            <%= safe_bro_time(command.created_at) %>
+            <%= command_flag(command) %>
+            <% if command.flag_reason.present? %><span class="bh-note"><%= command.flag_reason %></span><% end %>
+          </div>
+          <pre class="bh-cmd-code"><%= command.statements %></pre>
+        </div>
+      <% end %>
+    </div>
+  </section>
+
+  <div class="bh-split-aside">
+    <section class="bh-block">
+      <h2 class="bh-h2">Details</h2>
+      <dl class="bh-dl">
+        <dt>User</dt><dd><%= @session.username %></dd>
+        <dt>Reason</dt><dd><%= @session.reason %></dd>
+        <dt>Started</dt><dd><%= safe_bro_time(@session.started_at) %></dd>
+        <dt>Ended</dt><dd><%= @session.ended_at ? safe_bro_time(@session.ended_at) : "still open, or ended abruptly" %></dd>
+        <dt>Source</dt><dd><%= @session.source %></dd>
+        <dt>Host</dt><dd><%= @session.hostname %> (pid <%= @session.pid %>)</dd>
+        <dt>Unlocks</dt><dd class="bh-tone-amber"><%= @session.sensitive_accesses.size %></dd>
+        <dt>Flagged</dt><dd class="bh-tone-red"><%= flagged_count %></dd>
+      </dl>
+    </section>
+
+    <section class="bh-block">
+      <h2 class="bh-h2">Verdict</h2>
+      <% if @can_audit_this %>
+        <%= form_with url: session_audits_path(@session), scope: :audit do |form| %>
+          <% filter_params.each do |key, value| %>
+            <%= hidden_field_tag(key == :status ? :filter_status : key, value) %>
+          <% end %>
+          <div class="bh-seg">
+            <label class="is-ok"><%= form.radio_button :status, "approved", checked: true %><span>Appropriate</span></label>
+            <label class="is-bad"><%= form.radio_button :status, "flagged" %><span>Flag</span></label>
+          </div>
+          <label class="bh-field" style="margin-top:22px">Notes
+            <%= form.text_area :notes, rows: 4, class: "bh-textarea" %>
+          </label>
+          <div class="bh-hint">Required when flagging. Stored encrypted.</div>
+          <%= form.submit "Save and next", class: "bh-btn", style: "margin-top:20px" %>
+        <% end %>
+      <% else %>
+        <p class="bh-hint">This is your own session. Someone else has to review it.</p>
+      <% end %>
+
+      <% if @audits.any? %>
+        <h2 class="bh-h2" style="margin-top:32px">History</h2>
+        <dl class="bh-dl">
+          <% @audits.each do |audit| %>
+            <dt><%= review_status_text(audit.status == "approved" ? "approved" : audit.status) %></dt>
+            <dd><%= audit.auditor %> <span class="bh-cell-muted"><%= safe_bro_time(audit.created_at) %></span><br><%= audit.notes %></dd>
+          <% end %>
+        </dl>
+      <% end %>
+    </section>
+  </div>
+</div>

data/app/views/safe_bro/shared/forbidden.html.erb

@@ -0,0 +1,3 @@
+<% bro_hub_crumb "Not allowed" %>
+<%= bro_hub_hero eyebrow: "Console sessions", title: "Not allowed", tone: :red,
+      lead: "You don't have permission to review console sessions. Ask an admin if you need access." %>

data/app/views/safe_bro/unlocks/index.html.erb

@@ -0,0 +1,25 @@
+<% bro_hub_crumb "Unlocks" %>
+<%= bro_hub_hero eyebrow: "Unlocks", title: @total, tone: (:amber if @total > 0), subtitle: (@total == 1 ? "unlock" : "unlocks"),
+      lead: "Every time someone unlocked sensitive data, with the reason they gave. Newest first.",
+      stats: [ [ @open_total, "still open", :amber ] ] %>
+
+<div class="bh-table-wrap">
+  <div class="bh-table" style="--cols: 150px 120px 140px minmax(240px,1fr) 90px 80px; --min: 900px">
+    <div class="bh-row is-head"><span>Unlocked</span><span>User</span><span>Scope</span><span>Why</span><span>Commands</span><span>Session</span></div>
+    <% @unlocks.each do |unlock| %>
+      <%= link_to session_path(unlock.session_id), class: "bh-row bh-edge-amber" do %>
+        <span class="bh-tone-violet"><%= safe_bro_time(unlock.started_at) %></span>
+        <span class="bh-cell-strong"><%= unlock.session.username %></span>
+        <span class="bh-tags">
+          <span class="bh-tag is-amber"><%= unlock.resources %></span>
+          <%= content_tag(:span, "open", class: "bh-tag") if unlock.open? %>
+        </span>
+        <span class="bh-cell-text"><%= unlock.justification %></span>
+        <span><%= @command_counts.fetch(unlock.id, 0) %></span>
+        <span class="bh-tone-violet">#<%= unlock.session_id %></span>
+      <% end %>
+    <% end %>
+    <% if @unlocks.empty? %><div class="bh-empty">Nobody unlocked anything.</div><% end %>
+    <%= safe_bro_pager total: @total, page: @page, noun: "unlock" %>
+  </div>
+</div>

data/config/routes.rb

@@ -0,0 +1,11 @@
+SafeBro::Engine.routes.draw do
+  root "sessions#index"
+
+  resources :sessions, only: %i[ index show ] do
+    resources :audits, only: :create
+  end
+
+  get "flagged" => "flagged_commands#index", as: :flagged_commands
+  get "unlocks" => "unlocks#index", as: :unlocks
+  get "rules" => "rules#show", as: :rules
+end

data/db/migrate/20261114000001_create_safe_bro_tables.rb

@@ -0,0 +1,52 @@
+class CreateSafeBroTables < ActiveRecord::Migration[7.1]
+  def change
+    create_table :safe_bro_sessions do |t|
+      t.string :username, null: false
+      t.text :reason, null: false
+      t.string :source, null: false, default: "console"
+      t.string :hostname
+      t.integer :pid
+      t.integer :review_status, null: false, default: 0
+      t.datetime :started_at, null: false
+      t.datetime :ended_at
+
+      t.timestamps
+
+      t.index :started_at
+      t.index [ :username, :started_at ]
+      t.index [ :review_status, :started_at ]
+    end
+
+    create_table :safe_bro_sensitive_accesses do |t|
+      t.references :session, null: false, index: true
+      t.string :resources, null: false, default: "all"
+      t.text :justification, null: false
+      t.datetime :started_at, null: false
+      t.datetime :ended_at
+
+      t.timestamps
+    end
+
+    create_table :safe_bro_commands do |t|
+      t.references :session, null: false, index: false
+      t.references :sensitive_access, index: true
+      t.text :statements
+      t.integer :status, null: false, default: 0
+      t.text :flag_reason
+
+      t.timestamps
+
+      t.index [ :session_id, :created_at ]
+      t.index :status
+    end
+
+    create_table :safe_bro_audits do |t|
+      t.references :session, null: false, index: true
+      t.string :auditor, null: false
+      t.integer :status, null: false
+      t.text :notes
+
+      t.timestamps
+    end
+  end
+end

data/lib/generators/safe_bro/install/install_generator.rb

@@ -0,0 +1,35 @@
+require "rails/generators"
+require "generators/bro_hub/installable"
+
+module SafeBro
+  module Generators
+    # bin/rails generate safe_bro:install
+    class InstallGenerator < Rails::Generators::Base
+      # BroHub first (one mount for all the Bro gems), then SafeBro itself.
+      include BroHub::Generators::Installable
+
+      source_root File.expand_path("templates", __dir__)
+
+      desc "Sets up the BroHub dashboard (the review UI lives in it), adds the SafeBro initializer and copies the migrations."
+
+      def copy_initializer
+        copy_file "safe_bro.rb", "config/initializers/safe_bro.rb"
+      end
+
+      def copy_migrations
+        rails_command "safe_bro:install:migrations", inline: true
+      end
+
+      def next_steps
+        say <<~TEXT
+
+          SafeBro is installed. Next:
+            1. bin/rails db:migrate
+            2. Say who may review sessions in config/initializers/safe_bro.rb (config.can_audit)
+            3. Make sure every console user arrives with CONSOLE_USER set (see the README)
+            4. Visit #{bro_hub_path}/safe_bro (BroHub mounts SafeBro under its own path)
+        TEXT
+      end
+    end
+  end
+end

data/lib/generators/safe_bro/install/templates/safe_bro.rb

@@ -0,0 +1,45 @@
+SafeBro.configure do |config|
+  # --- Who may review console sessions in the SafeBro UI --------------------------------
+  # Nobody until you say so. The review UI is a section of the BroHub dashboard, so who is
+  # signed in comes from BroHub.config.current_user (your ApplicationController's `current_user`
+  # by default). Override it for SafeBro only with config.current_user below.
+  config.can_audit = ->(user) { false }
+  # config.current_user = ->(controller) { controller.current_user }
+  # config.user_label = ->(user) { user.email }
+  # config.allow_self_audit = false
+
+  # --- Where SafeBro acts ----------------------------------------------------------------
+  # Consoles started in these environments are recorded and guarded.
+  # config.protected_environments = %w[ production ]
+
+  # How SafeBro learns who is at the console. Set it where you can trust it: with SSH,
+  # `environment="CONSOLE_USER=jane"` on the key in authorized_keys. A SetEnv from the
+  # client can be set to anything.
+  # config.username_resolver = -> { ENV["CONSOLE_USER"] }
+  # config.ask_for_username_if_empty = false
+
+  # --- What is protected until someone runs unlock! ---------------------------------------
+  # config.protected_resources = %i[ encrypted_data credentials env files network ]
+  # config.protected_urls = [ "redis://cache.internal:6379", "https://search.internal:9200" ]
+  # config.protected_env_patterns += [ /STRIPE/ ]
+  # config.protected_file_patterns += [ %r{config/.*\.pem\z} ]
+
+  # --- Guardrails -------------------------------------------------------------------------
+  # config.forbidden_methods += [ "Kernel#open" ]
+  # config.suspicious_terms += [ "DROP TABLE" ]
+
+  # --- Retention ---------------------------------------------------------------------------
+  # Sessions older than this are removed by SafeBro::PurgeJob (schedule it) or
+  # `bin/rails safe_bro:purge`. Flagged sessions are kept. nil keeps everything.
+  # config.retention = 90.days
+  # config.keep_flagged = true
+
+  # Also record `rails runner` invocations as sessions.
+  # config.audit_runner = false
+end
+
+# Get told when something needs attention:
+#
+# ActiveSupport::Notifications.subscribe("command_flagged.safe_bro") do |*, payload|
+#   SecurityMailer.console_flag(payload[:session], payload[:reason]).deliver_later
+# end

data/lib/safe_bro/cipher.rb

@@ -0,0 +1,45 @@
+module SafeBro
+  # Recorded commands are encrypted at rest so that someone who can read the database (or a
+  # backup) can't read what people typed, which may include customer data.
+  module Cipher
+    # The encryptor serializes values before encrypting; we only ever pass strings.
+    module Raw
+      def self.dump(value) = value
+      def self.load(value) = value
+    end
+
+    class << self
+      def encrypt(text)
+        return text if text.nil?
+
+        encryptor.encrypt_and_sign(text.to_s)
+      end
+
+      def decrypt(cipher_text)
+        return cipher_text if cipher_text.nil?
+
+        encryptor.decrypt_and_verify(cipher_text) || "[could not decrypt]"
+      rescue ActiveSupport::MessageEncryptor::InvalidMessage, ActiveSupport::MessageVerifier::InvalidSignature
+        "[could not decrypt]"
+      end
+
+      def reset!
+        @encryptor = nil
+      end
+
+      private
+        def encryptor
+          @encryptor ||= ActiveSupport::MessageEncryptor.new(key, cipher: "aes-256-gcm", serializer: Raw)
+        end
+
+        def key
+          configured = SafeBro.config.encryption_key
+          configured = configured.call if configured.respond_to?(:call)
+          configured ||= Rails.application.key_generator.generate_key("safe_bro/commands", 32)
+          raise Error, "SafeBro encryption_key must be 32 bytes" unless configured.bytesize == 32
+
+          configured
+        end
+    end
+  end
+end

data/lib/safe_bro/commands.rb

@@ -0,0 +1,25 @@
+module SafeBro
+  # The commands people can type into the console: `unlock!` and `lock!`.
+  module Commands
+    class Unlock < IRB::Command::Base
+      category "SafeBro"
+      description "Get access to protected data (asks why, and records it). Optionally name what: unlock! :credentials"
+
+      def execute(arg)
+        resources = arg.to_s.scan(/\w+/).map(&:to_sym)
+        SafeBro.shield.unlock(resources.presence || [ :all ])
+        nil
+      end
+    end
+
+    class Lock < IRB::Command::Base
+      category "SafeBro"
+      description "Protect sensitive data again."
+
+      def execute(_arg)
+        SafeBro.shield.lock
+        nil
+      end
+    end
+  end
+end

data/lib/safe_bro/configuration.rb

@@ -0,0 +1,153 @@
+module SafeBro
+  class Configuration
+    # --- Where it runs -------------------------------------------------------------------
+
+    # SafeBro only acts on consoles started in these environments. Override with `enabled`.
+    attr_accessor :protected_environments
+
+    # true/false to force it on or off regardless of the environment.
+    attr_accessor :enabled
+
+    # Also record `rails runner` invocations as sessions.
+    attr_accessor :audit_runner
+
+    # --- Who is using the console --------------------------------------------------------
+
+    # -> { "name" } The identity of the person at the console. Trust this only as much as the
+    # layer that sets it (e.g. SSH `environment=` in authorized_keys is trustworthy, `SetEnv`
+    # from the client is not).
+    attr_accessor :username_resolver
+
+    # Ask on the terminal when the resolver returns nothing (otherwise the console refuses to start).
+    attr_accessor :ask_for_username_if_empty
+
+    # --- What is protected ---------------------------------------------------------------
+
+    # Which resources need unlock! (see Shield::RESOURCES).
+    attr_accessor :protected_resources
+
+    # URLs (https://host:port, redis://host:port, host:port) that can't be reached while locked.
+    attr_accessor :protected_urls
+
+    # ENV names that can't be read while locked (matched against the variable name).
+    attr_accessor :protected_env_patterns
+
+    # Files that can't be read from the console while locked.
+    attr_accessor :protected_file_patterns
+
+    # --- Guardrails ----------------------------------------------------------------------
+
+    # Classes/modules the console may not reopen (class Foo / module Foo / Foo.class_eval...).
+    attr_accessor :forbidden_reopening
+
+    # Constants the console may not reference. :always, or only while :locked.
+    attr_accessor :forbidden_constants
+
+    # "Owner#instance_method" or "Owner.singleton_method" that can't be called from the console.
+    attr_accessor :forbidden_methods
+
+    # Commands containing one of these are allowed but recorded as suspicious.
+    attr_accessor :suspicious_terms
+
+    # Freeze SafeBro's own classes once installed so they can't be monkey patched.
+    attr_accessor :freeze_internals
+
+    # --- Storage and review --------------------------------------------------------------
+
+    # Keep sessions this long, nil to keep forever (see SafeBro::PurgeJob / safe_bro:purge).
+    attr_accessor :retention
+
+    # Don't purge sessions an auditor flagged.
+    attr_accessor :keep_flagged
+
+    # 32 bytes (or a ->{ } returning them) used to encrypt recorded commands. Defaults to a key
+    # derived from the app's secret_key_base.
+    attr_accessor :encryption_key
+
+    # Controller the engine controllers inherit from (gives access to your authentication).
+    attr_accessor :parent_controller
+
+    # ->(controller) { user or nil }. Defaults to BroHub.config.current_user, so configuring BroHub once is enough.
+    attr_accessor :current_user
+
+    # ->(user) { "label" } shown in the UI and stored on audits. Defaults to BroHub.config.user_label.
+    attr_accessor :user_label
+
+    # ->(user) { true/false } may this user review sessions in the UI?
+    attr_accessor :can_audit
+
+    # May an auditor approve their own sessions? (compared by user_label vs session username)
+    attr_accessor :allow_self_audit
+
+    attr_accessor :require_ssl
+
+    # Texts shown in the console.
+    attr_accessor :welcome_message, :unlock_prompt, :unlocked_message, :locked_message
+
+    def initialize
+      @protected_environments = %w[ production ]
+      @enabled = nil
+      @audit_runner = false
+
+      @username_resolver = -> { ENV["CONSOLE_USER"] }
+      @ask_for_username_if_empty = false
+
+      @protected_resources = %i[ encrypted_data credentials env files network ]
+      @protected_urls = []
+      @protected_env_patterns = [ /SECRET/i, /TOKEN/i, /PASSWORD/i, /PASSPHRASE/i, /CREDENTIAL/i, /API_?KEY/i, /PRIVATE/i, /MASTER_?KEY/i, /DATABASE_URL/i, /\A[A-Z_]*KEY\z/ ]
+      @protected_file_patterns = [ %r{config/master\.key\z}, %r{config/credentials/.+\.key\z}, %r{(\A|/)\.env(\.[^/]+)?\z} ]
+
+      @forbidden_reopening = %w[ ActiveRecord ApplicationRecord SafeBro IRB ]
+      @forbidden_constants = {
+        always: %w[ SafeBro IRB ObjectSpace ],
+        locked: %w[ ActiveRecord::Encryption Open3 PTY Fiddle ]
+      }
+      @forbidden_methods = %w[
+        Kernel#eval Kernel.eval BasicObject#instance_eval BasicObject#instance_exec
+        Module#class_eval Module#module_eval Module#class_exec Module#module_exec
+        Kernel#system Kernel#exec Kernel#spawn Kernel#` Kernel#fork
+        Kernel.system Kernel.exec Kernel.spawn Kernel.` Kernel.fork
+        Process.spawn Process.exec Process.fork IO.popen
+      ]
+      @suspicious_terms = %w[ secret credentials master.key ENV safe_bro SafeBro ]
+      @freeze_internals = true
+
+      @retention = 90.days
+      @keep_flagged = true
+      @encryption_key = nil
+
+      @parent_controller = "::ApplicationController"
+      @current_user = ->(controller) { BroHub.config.current_user.call(controller) }
+      @user_label = ->(user) { BroHub.config.user_label.call(user) }
+      @can_audit = ->(_user) { false }
+      @allow_self_audit = false
+      @require_ssl = defined?(Rails) && Rails.env.production?
+
+      @welcome_message = "You have access to production data here. That's a big deal. Everything you type is recorded and " \
+                         "reviewed. Be careful, be brief, and don't look at data you don't need."
+      @unlock_prompt = "Before you access sensitive data (encrypted attributes, credentials, ENV, protected systems), " \
+                       "say why and where we can find the consent or ticket that covers it."
+      @unlocked_message = "Unlocked. We pay extra close attention to everything you do now. Type lock! to protect it again."
+      @locked_message = "Locked again. When we review, we may reach out about what you did while unlocked."
+    end
+
+    def enabled?
+      return enabled unless enabled.nil?
+
+      protected_environments.map(&:to_s).include?(Rails.env.to_s)
+    end
+
+    def protected_env_name?(name)
+      protected_env_patterns.any? { |pattern| pattern.match?(name.to_s) }
+    end
+
+    # Freezes everything so it can't be altered from a console.
+    def lock_down!
+      [ protected_environments, protected_resources, protected_urls, protected_env_patterns, protected_file_patterns,
+        forbidden_reopening, forbidden_methods, suspicious_terms ].each(&:freeze)
+      forbidden_constants.each_value(&:freeze)
+      forbidden_constants.freeze
+      freeze
+    end
+  end
+end

data/lib/safe_bro/encrypted_type.rb

@@ -0,0 +1,16 @@
+module SafeBro
+  # ActiveRecord attribute type that stores text encrypted with SafeBro::Cipher.
+  class EncryptedType < ActiveRecord::Type::Text
+    def serialize(value)
+      super(value.nil? ? nil : Cipher.encrypt(value))
+    end
+
+    def deserialize(value)
+      value.nil? ? nil : Cipher.decrypt(super)
+    end
+
+    def changed_in_place?(raw_old_value, new_value)
+      deserialize(raw_old_value) != new_value
+    end
+  end
+end

data/lib/safe_bro/engine.rb

@@ -0,0 +1,33 @@
+module SafeBro
+  class Engine < ::Rails::Engine
+    isolate_namespace SafeBro
+
+    # The review UI is a section of the BroHub dashboard. Registered before routes are drawn,
+    # so BroHub can mount this engine under <hub>/safe_bro.
+    initializer "safe_bro.bro_hub" do
+      BroHub.register :safe_bro,
+        name: "SafeBro", label: "SafeBro · audit", accent: :red, order: 10,
+        engine: "SafeBro::Engine",
+        visible_to: ->(user) { SafeBro.config.can_audit.call(user) },
+        items: [
+          { label: "Sessions", path: "/", match: %r{\A/(sessions(/|\z)|\z)}, badge: -> { SafeBro::Session.review_pending.count } },
+          { label: "Flagged commands", path: "/flagged" },
+          { label: "Unlocks", path: "/unlocks" },
+          { label: "Rules", path: "/rules" }
+        ]
+    end
+
+    # Nothing is installed by merely loading the gem. Protections start with the console.
+    console do
+      SafeBro.supervisor.run_console if SafeBro.enabled?
+    end
+
+    runner do
+      SafeBro.supervisor.run_runner if SafeBro.enabled? && SafeBro.config.audit_runner
+    end
+
+    rake_tasks do
+      load File.expand_path("../tasks/safe_bro.rake", __dir__)
+    end
+  end
+end