Skip to content

SECURITY.md

Latest commit

 

History

History
62 lines (42 loc) · 2.06 KB

SECURITY.md

File metadata and controls

62 lines (42 loc) · 2.06 KB
Raw

Security Policy

Supported Versions

SigilGuard provides security fixes for the latest 1.x release line.

After 1.0.0 is published, the final 0.2.x release line receives security fixes for six months.

Reporting A Vulnerability

Report suspected vulnerabilities through GitHub private vulnerability reporting for this repository. Do not open a public issue for an unpatched vulnerability.

Please include:

  • Affected version or commit.
  • Reproduction steps or a proof of concept.
  • Expected impact and affected surface.
  • Any known mitigations.

Response Targets

  • Acknowledgement within 72 hours.
  • Triage verdict within 7 days.
  • Fix, coordinated disclosure plan, or public advisory within 90 days.

These are response targets, not guarantees. Complex reports may require coordination with downstream applications or upstream protocol owners.

Scope

In scope:

  • SigilGuard runtime decisions, scanners, policies, audit proofs, vault primitives, trust bundles, attestation, and release provenance.
  • Build, dependency, and release artifacts shipped by this repository.

Out of scope:

  • Host application authentication, transport security, sandbox provisioning, deployment policy, or remote network services.
  • Vulnerabilities caused by unsafe host integration outside SigilGuard's public contracts.

Signer Compromise

Treat signing-key compromise as an incident. For trust-bundle signer compromise, follow the emergency rotation ceremony defined in the trust-bundle specification, found under docs/specs/ in the source repository.

Repository Secret Scanning

./bin/check-secrets scans the complete Git history with a pinned Gitleaks release and verifies the downloaded archive checksum before execution. The canonical ./bin/check gate runs it in CI and locally.

SigilGuard's scanner tests deliberately contain synthetic credential-shaped strings. .gitleaksignore acknowledges only the exact reviewed historical fingerprints for those fixtures. Do not add path-wide exclusions: any changed or new credential-shaped fixture must be reviewed as a fresh finding.