Security Policy

Security Policy

Reporting Vulnerabilities

DO NOT report through public GitHub issues. Email maintainers directly or use GitHub's private vulnerability reporting.

Include: description, reproduction steps, affected versions, impact assessment. Acknowledgment within 48 hours. Initial assessment within 7 days. 14-day minimum embargo before public disclosure.

Security Design Summary

Input Validation (27 Validators)

Every parameter entering the framework passes through whitelist-based validators in core/validation.py (1,256 lines). Validators are pure functions that raise ValidationError on invalid input. Whitelist approach: everything not explicitly permitted is rejected.

Subprocess Security

NEVER shell=True. All commands use list-form subprocess.run() with 30-second timeout and stderr capture. This is verified by make security-scan (6 static pattern checks) on every build.

Log Sanitization (4-Family)

LogSanitizer masks credentials before they reach any log handler:

• Key-value: password=secret → password=***MASKED***
• Quoted: password="secret" → password="***MASKED***"
• JSON: {"password": "secret"} → {"password": "***MASKED***"}
• Auth headers: Bearer eyJ... → Bearer ***MASKED***

11 sensitive keywords recognized. Control characters stripped (CWE-117 prevention).

File Security

All files 0o600, all directories 0o700. umask 0o077. Atomic writes (temp→replace). Path traversal rejection (.. and null byte \x00). SHA-256 integrity verification on backups and imports.

Process Security

Root check, context-aware signal handling (SIGTERM/SIGHUP always terminate through the cleanup stack; SIGINT aborts the current operation and recovers to the menu inside interactive sessions, and terminates with cleanup in headless execution), file locking (fcntl.flock with stale PID detection), sensitive value scrubbing on cleanup, CleanupStack with LIFO execution.

CWE Coverage

CWE	Vulnerability	Test Coverage
CWE-78	OS Command Injection	9 injection payloads across all input types
CWE-22	Path Traversal	../ sequences and null byte injection
CWE-79	Cross-Site Scripting	HTML tag injection in sanitize_input()
CWE-117	Log Injection	Control character stripping
CWE-20	Improper Input Validation	42 unit tests across all 27 validators

Static analysis via make security-scan: no shell=True, no eval(), no exec(), no pickle/marshal, no hardcoded credentials, no TODO/FIXME markers.

Threat Model

Threat	Mitigation
Command injection	27 whitelist validators + list-form subprocess
Path traversal	validate_file_path() rejects .. and null bytes
Import tampering	SHA-256 sidecar verification
Unauthorized access	Root check + 0o600/0o700 perms + umask
Log injection	Control char stripping + credential masking
Stale lock DoS	PID validation + automatic recovery
Partial write corruption	Atomic temp→replace for all persistent data
Timing side channels	hmac.compare_digest() for checksums

Known Limitations

1. Python GC doesn't guarantee timely sensitive memory scrubbing
2. Log rotation at 100MB × 10 files; use external rotation for high-traffic
3. Containers may lack netfilter kernel modules
4. Cross-process rule index access is not file-locked
5. TTL precision: ±30 seconds (ExpiryMonitor interval)
6. IPv6 validation uses simplified regex pattern