Skip to content

Security: momomuchu/make-no-mistakes

Security

SECURITY.md

Security Policy

Reporting

Please report vulnerabilities privately via GitHub Security Advisories. No public issues for exploitable bugs.

A note on trust

/make-no-mistakes is a verification harness: it runs scripts and gates with real tool access on your machine. Treat it like any code you execute — read it before you install it. That rule is the project's own philosophy applied to itself: don't trust, verify.

Supported versions

Pre-1.0: only the latest release (see CHANGELOG.md / Releases) receives security fixes. Pin a tag if you need a stable base; upgrade to report or receive a fix.

Threat model — what this does and does not defend against

The harness makes accidental and casually-adversarial false-DONEs expensive and loud. It is not a sandbox and does not defend against a determined attacker who already controls the shell it runs in. Named, honest limits (each also documented in SKILL.md / docs/specs/STATUS.md):

  • In-band checks are bypassable in principle. Every gate runs in a shell the agent under test also controls — e.g. MNM_SKIP_REVERIFY (a loud, test-only escape hatch) or controlling the working directory. The real trust roots are out of band: the ed25519-signed manifest (key held outside the repo), the independent mnm-verify sub-agent, and CI re-running the gates in a clean environment.
  • The verdict-log hash chain is tamper-evident, not forgery-proof. It is an unkeyed SHA-256 over public scripts; an adversary who reproduces the formula can hand-compute a valid chain. Forgery-proofing rests on the signed manifest + external CI, not the chain alone.
  • The adversarial-panel-skip residual: an agent whose code genuinely passes the deterministic gates can still skip the deeper adversarial-panel scrutiny. Closing it in-band would violate the author≠verifier independence the harness exists to enforce.
  • The PreToolUse Bash-hook coverage is heuristic (an agent can obfuscate a write/read); the deterministic backstop is the hash-anchor integrity gate, not the hook.
  • A co-installed malicious hook or a tampered surrounding runtime is out of scope — the signed manifest detects tampering of the harness's own files, not of the agent runtime around it.

There aren't any published security advisories