Security: policy_checks.py silently bypasses enforcement on malformed YAML

[sergio-sisternes-epam]

Summary

src/apm_cli/policy/policy_checks.py at approximately line 30 silently bypasses policy enforcement when the YAML policy file is malformed. Instead of raising an error or warning, the function returns a permissive default, effectively disabling all policy checks.

Context

Identified during Round 2 of the APM codebase quality audit (PR #918 discussion). The APM CEO flagged this as a supply-chain security concern: a malformed policy file (whether accidental or crafted) should NOT result in all checks being silently skipped.

Expected behaviour

When a policy YAML file fails to parse, the system should:

1. Log a clear warning or error indicating the policy file is malformed
2. Either fail closed (reject the operation) or explicitly warn the user that policy enforcement is disabled
3. Never silently proceed as if no policy exists

Current behaviour

A malformed YAML file causes the parser to return a default/empty policy object, which passes all checks. No warning is emitted.

Security impact

An attacker who can introduce a subtly malformed policy file (e.g., via a PR to a shared policy repo) could disable all policy enforcement for downstream consumers without any visible indication.

Recommended approach

• Fail closed: if the policy file exists but cannot be parsed, treat it as a policy violation
• At minimum, emit a prominent warning (not just logger.debug) when falling back to permissive defaults
• Add a test case for malformed YAML producing a clear error rather than silent bypass

Related

• PR refactor: complexity audit -- eliminate god-method forks, O(n^2) loops, redundant I/O #918: Complexity audit and benchmarks
• Round 2 finding F2 (CEO-ratified)