You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Harden repository security posture and CI supply chain
Add the governance and security files a public standards repository is
expected to carry, and close two live weaknesses in the version-sync
workflow.
SECURITY.md publishes a vulnerability disclosure policy with scope,
response SLAs, coordinated-disclosure timeline, and safe harbor. Private
vulnerability reporting was already enabled but nothing pointed
researchers at it. An issue-template config now routes security reports
away from public issues.
CODEOWNERS requires review from admins and maintainers, with the
specification, CI, and licensing paths called out. All nine handles were
verified to hold write access, since GitHub fails invalid entries
silently.
dependabot.yml adds version updates for GitHub Actions and uv, each with
a seven-day cooldown. A compromised release is most dangerous in the
hours after publication, and registry takeovers are usually yanked
within days.
Workflow hardening in sync_version.yml:
- Pin all three actions to commit SHAs. Mutable tags meant a compromised
tag would execute with contents:write. All three were also majors
behind: checkout v4 to v7, setup-uv v4 to v9, create-pull-request v5
to v8.
- Pin uv to 0.9.9 instead of resolving "latest" at run time.
- Close a script-injection path. The contents of version.txt were
interpolated into a shell command through ${{ }}. The value is now
validated against a semver pattern and passed through the environment.
- Default to permissions:{} at the workflow level and grant contents and
pull-requests write only on the job that needs them.
- Add a concurrency group and enable commit signing on generated PRs.
Secret-scanning and gitleaks allowlists cover the signed agent-card
examples in the A2A hook documentation. A full history scan across 250
commits found 12 findings, all from one commit, all documentation JWTs
that authenticate nothing. Without the allowlists, push protection
blocks anyone editing the A2A specification and contributors learn to
click through the warning.
Signed-off-by: rocklambros <rock@rockcyber.com>
ACS is a specification. Most of what lives here is prose and JSON Schema, so the security surface is narrower than a typical software project. Report anything you find anyway. A flaw in the specification propagates into every implementation that follows it.
4
+
5
+
## Report a vulnerability
6
+
7
+
**Do not open a public issue.**
8
+
9
+
Use GitHub's [private vulnerability reporting](https://github.com/GenAI-Security-Project/agent-control-standard/security/advisories/new). Reports land with the maintainers and stay private until we publish an advisory together.
10
+
11
+
Include what you have:
12
+
13
+
- What you found and where, with a file path or a link to the specific line
14
+
- How to reproduce it, or the reasoning chain if the flaw is in the specification rather than in code
15
+
- What an attacker gains
16
+
- Any suggested fix
17
+
18
+
Partial reports are welcome. We would rather triage something incomplete than never hear about it.
19
+
20
+
## What is in scope
21
+
22
+
| In scope | Out of scope |
23
+
| --- | --- |
24
+
| Flaws in the ACS specification that lead implementers into insecure designs | The documentation site at agentcontrolstandard.ai, which is built from a separate repository |
25
+
| Errors in the JSON Schemas under `specification/`| Findings against third-party agent frameworks that happen to implement ACS |
26
+
| The GitHub Actions workflows in `.github/workflows/`| Automated scanner output with no demonstrated impact |
27
+
| Hook or event definitions that leak sensitive data by design | Missing security headers on sites we do not operate |
28
+
| Supply-chain issues in this repository's dependencies | Social engineering of maintainers or contributors |
29
+
30
+
A specification flaw counts. If a hook definition forces implementers to log secrets, or an event schema makes an authorization bypass easy to write, that is a finding even though no code here executes.
31
+
32
+
## Response commitments
33
+
34
+
| Stage | Target |
35
+
| --- | --- |
36
+
| Acknowledge your report | 3 business days |
37
+
| Initial triage and severity assessment | 10 business days |
38
+
| Fix or documented mitigation for high and critical findings | 90 days from triage |
39
+
| Public advisory | Coordinated with you, at or before day 90 |
40
+
41
+
We use [CVSS v3.1](https://www.first.org/cvss/calculator/3.1) for severity. Specification flaws get scored against a reference implementation, since the specification itself has no runtime.
42
+
43
+
## Coordinated disclosure
44
+
45
+
We publish an advisory once a fix ships, or at 90 days from triage, whichever comes first. If a fix needs longer, we tell you why and agree a new date rather than letting the clock run out quietly.
46
+
47
+
Tell us how you want to be credited, including if you prefer not to be. We credit reporters in the advisory by default.
48
+
49
+
If you believe a finding is being actively exploited, say so in the report. That moves it to the front of the queue and shortens every window above.
50
+
51
+
## Safe harbor
52
+
53
+
We will not pursue or support legal action against research conducted under this policy, provided you:
54
+
55
+
- Report through the private channel above and give us a chance to fix the issue before disclosing it
56
+
- Avoid privacy violations, data destruction, and interruption of any service
57
+
- Access only the minimum data needed to demonstrate the finding, and delete it once you have reported
58
+
- Do not exploit a finding beyond what proving it requires
59
+
60
+
Work in good faith under these terms and we treat your research as authorized. If a third party brings action against you for research that followed this policy, we will make that authorization clear.
61
+
62
+
## Signing and provenance
63
+
64
+
Contributors sign off commits under the Developer Certificate of Origin. See [CONTRIBUTING.md](./CONTRIBUTING.md).
65
+
66
+
Report suspected compromise of a maintainer account or a release artifact through the private channel above, marked urgent.
0 commit comments