DO NOT open public issues for security vulnerabilities.

Email: Robert5560newton@gmail.com
Response Time: Within 48 hours

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (optional)
• Your contact information

CCMD implements multiple security layers:

• ✅ 35+ dangerous patterns blocked
• ✅ Shell metacharacter validation
• ✅ Command chaining prevention (&&, ||, ;)
• ✅ Backtick and $() execution blocking
• ✅ Path traversal protection

• ✅ bcrypt password hashing (100k iterations)
• ✅ PBKDF2 fallback for compatibility
• ✅ Master password protection for sensitive commands
• ✅ Secure password storage with file permissions (0600)

• ✅ shell=False enforcement for user commands
• ✅ 180s timeout for non-interactive commands
• ✅ Input sanitization for all commands
• ✅ Context-aware command validation
• ✅ Type enforcement for custom commands

• ✅ SSH key permission validation
• ✅ Encrypted SSH key storage
• ✅ Key fingerprint verification

• ✅ Atomic file operations
• ✅ Safe backup and rollback system
• ✅ Permission checks before operations

• 2025-10-30 Bandit scan: 2 HIGH, 5 MEDIUM, 38 LOW issues identified
• 2025-10-30 Safety check: 0 vulnerabilities (6 ignored in unpinned packages)
• 2025-10-30 CodeQL scan: Pending setup

• No community audits yet - Contact us to contribute

• Planned for Q1 2026 - Contributions welcome

We aim to:

1. Acknowledge report within 48 hours
2. Provide initial assessment within 1 week
3. Release patch within 2 weeks (for HIGH/CRITICAL)
4. Public disclosure 30 days after patch release

1. Security issues are prioritized above feature requests
2. Patches are released as soon as possible
3. All users are notified through GitHub releases
4. Security changelog is maintained in SECURITY_CHANGELOG.md

1. Tarfile extraction without validation (HIGH) - Fix planned for v1.1.3
2. subprocess with shell=True for system commands (HIGH) - Under review
3. URL open without scheme validation (MEDIUM) - Fix planned for v1.1.3

• System commands require shell=True for proper expansion
• Interactive commands inherit terminal for user interaction
• Master password uses bcrypt with PBKDF2 fallback for compatibility

1. Keep CCMD Updated - Always use the latest version
2. Use Strong Master Password - Minimum 8 characters recommended
3. Review Custom Commands - Audit any custom commands before adding
4. Limit SSH Key Access - Only add necessary SSH keys
5. Regular Backups - Use the rollback feature for safety

Security researchers who have helped improve CCMD:

• Be the first contributor! Report a vulnerability to get listed here

Security Lead: De Catalyst (@Wisyle)
Email: Robert5560newton@gmail.com
Twitter: @iamdecatalyst
GitHub: @Wisyle

This security policy is updated regularly. Last update: 2025-10-30