Skip to content

EvidenceVeil v1.0.0

Choose a tag to compare

View all tags
@MrTaherAmine MrTaherAmine released this 24 Aug 04:21
· 22 commits to main since this release
v1.0.0
4aefb22
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

EvidenceVeil v1.0.0

Share incident data without exposing the incident.

EvidenceVeil is a local-first privacy engineering and security tool for sanitizing, pseudonymizing, de-identifying, auditing, and packaging cybersecurity evidence before it is shared with vendors, researchers, partners, responders, or other organizations.

Highlights

  • Local-first operation with no network dependency required for core processing
  • Sensitive-field discovery across common cybersecurity evidence formats
  • Policy-driven sanitization and pseudonymization
  • Deterministic keyed transformations where appropriate
  • Reversible investigation workflows using an encrypted external vault
  • Argon2id-based key derivation and ChaCha20-Poly1305 authenticated encryption
  • Residual privacy-risk auditing
  • Utility assessment and controlled-review decision support
  • Evidence integrity verification
  • Sanitized evidence bundle generation
  • Self-contained HTML reporting
  • CSV/TSV, JSON/JSONL, text/log, CEF, LEEF and gzip support
  • Archive traversal and unsafe extraction protections
  • CSV formula-injection neutralization
  • Synthetic demonstration datasets and built-in policies
  • CLI-based workflow suitable for analysts, DFIR teams, SOCs, CSIRTs and privacy/security engineers

Validation

The v1.0.0 release candidate was validated locally on macOS with Python 3.14.

Release validation included:

  • 44 automated tests passing
  • More than 92% branch-aware code coverage
  • Ruff static analysis passing
  • mypy type checking passing
  • pip dependency consistency checks passing
  • pip-audit reporting no known third-party dependency vulnerabilities
  • Bandit reporting 0 Low, 0 Medium and 0 High issues after reviewed suppressions
  • Source evidence immutability verification
  • Sanitization and restoration testing
  • Encrypted vault compatibility testing
  • Bundle verification
  • Wheel and source-distribution builds
  • Twine package validation

Automated GitHub CI and additional cross-platform validation will be introduced separately and should not be inferred from the local validation above.

Security

EvidenceVeil is designed to reduce disclosure risk, not to make absolute anonymization guarantees.

A successful sanitization run does not automatically mean that a dataset is anonymous, legally anonymized, or appropriate for unrestricted public disclosure. Residual-risk review remains important, especially for unique incident context and free-text evidence.

Encrypted restoration vaults should be stored separately from sanitized evidence packages.

See SECURITY.md and the project documentation for security guidance.

Installation

From the release wheel:

pip install evidenceveil-1.0.0-py3-none-any.whl
Assets 5
Loading