Skip to content

Security: KooshaPari/SessionLedger

Security

SECURITY.md

Security Policy

Supported Versions

Version Supported
0.1.x ✅
< 0.1 ❌

Security fixes land on the latest release line first. Older tags are not backported unless a maintainer explicitly commits to a patch release.

Reporting a Vulnerability

Please do not open a public GitHub issue for security reports.

Preferred channels (in order):

  1. GitHub Security Advisories ΓÇö Report a vulnerability on this repository.
  2. Email ΓÇö contact maintainer KooshaPari via the address listed on their GitHub profile (placeholder until a dedicated security inbox is published).

Include:

  • Affected version / commit
  • Reproduction steps or proof-of-concept
  • Impact assessment (confidentiality / integrity / availability)
  • Whether the issue is already public

Disclosure Timeline

Stage Target
Initial acknowledgement within 3 business days
Triage / severity assessment within 7 days of report
Fix or mitigation plan within 30 days (typical)
Public disclosure / advisory coordinated after a fix ships

We follow coordinated disclosure. If a fix cannot ship within 90 days, we will discuss interim guidance with the reporter before any public write-up.

Critical supply-chain or remote-code issues may be accelerated at maintainer discretion.

Commit signing

Supply Chain & SBOM

  • Dependency policy is enforced by deny.toml via cargo deny check (see .github/workflows/security.yml).

  • Secret scanning runs with gitleaks and TruffleHog (dual-scan) in the same workflow on PRs and pushes to main (plus a weekly scheduled full scan). Gitleaks uploads SARIF to GitHub code scanning when security-events write is available. Local pre-commit hooks use gitleaks only.

  • Dependency updates: renovate.json groups Cargo and GitHub Actions PRs and automerges patch (and Actions digest) updates after required CI checks pass. Weekly Dependabot (.github/dependabot.yml) remains as a secondary CVE/update surface until Renovate is the sole bot. Prefer reviewing Renovate majors manually.

  • CycloneDX SBOMs are produced in the qgate path as target/sbom.cdx.json and per-crate *.cdx.json artifacts (see .github/workflows/qgate.yml header comments). Packaging notes: packaging/README.md.

  • SBOM policy SSOT: docs/ops/sbom-policy.json pins cargo-cyclonedx and documents validation via scripts/sbom-validate-check.ps1.

  • Advisory scanning: cargo audit job in .github/workflows/security.yml.

  • SBOM upload: qgate uploads sbom-cyclonedx artifact from target/sbom.cdx.json.

  • CVE feed subscription (GHSA + OSV + NVD): maintainer process and evidence links in docs/ops/cve-feed-subscription.md. Hermetic proof: pwsh ./scripts/cve-feed-check.ps1 -SelfCheck.

  • Socket.dev supply-chain posture (optional org GitHub App complement): policy SSOT in docs/ops/socket-posture.md. Hermetic proof: pwsh ./scripts/socket-posture-check.ps1 -SelfCheck. Live org install is not attestable from this repository.

Cryptography inventory

SessionLedger uses SHA-256 content hashing (sha2) for dedup keys and operator-owned TLS at a reverse proxy for remote-style daemon deploys. There is no encryption-at-rest for OKF bundles or audit files and no in-tree KMS — Phase-0 defers app-level envelope encryption to host FDE / ACLs / vault injection. See the full inventory, TLS samples (Caddy/nginx), and KMS/at-rest guidance in docs/ops/crypto-inventory.md. STRIDE-lite context: docs/THREAT_MODEL.md.

API keys and secret rotation

SessionLedger is a single-user local companion. Do not commit real secrets.

Surface Guidance
Local env sample Copy .env.example into your shell or local env manager. Keep SL_API_KEY unset for default loopback trust, or set a local-only value outside the repo.
Optional write gate When SL_API_KEY is set, mutating HTTP routes require Authorization: Bearer … or X-API-Key: …. Details: docs/ops/local-trust-boundary.md.
Rotation Stop callers using the old key → replace SL_API_KEY in the daemon environment → restart sl-daemon → update automation headers. Treat the previous key as burned; do not reuse it.
Repo hygiene Never put live keys in .env.example, docs, fixtures, or commits. CI runs scripts/env-example-check.ps1 (required keys + no high-entropy secret patterns) and gitleaks/TruffleHog on the tree.

Privacy hygiene (single-tenant)

SessionLedger is a single-user local companion — not a multi-tenant hosted service. Operator guidance for PII in logs, transcript retention, redaction before export, and loopback trust lives in docs/ops/privacy-hygiene.md. STRIDE-lite disclosure context: docs/THREAT_MODEL.md. Bind and SL_API_KEY policy: docs/ops/local-trust-boundary.md.

Local verify:

pwsh -NoProfile -File scripts/env-example-check.ps1
pwsh -NoProfile -File scripts/privacy-hygiene-check.ps1 -SelfCheck
pre-commit run gitleaks

There aren't any published security advisories