-
-
Notifications
You must be signed in to change notification settings - Fork 0
Security
The canonical policy lives in SECURITY.md. This wiki page summarises and contextualises it.
Do not open a public issue for security reports. Email instead:
Include:
- Description of the vulnerability
- Steps to reproduce
- Potential impact (especially: does it allow tampering with a registered version's metadata in a way that downstream resolvers would accept?)
| Stage | Target |
|---|---|
| Acknowledgement | within 48 hours |
| Initial assessment | within 7 days |
| Fix or mitigation | within 90 days |
We will not pursue legal action against security researchers who follow responsible disclosure.
A vulnerability in this repo is one of:
- An issue in the registry's own metadata (e.g. a Registry.toml entry that mis-resolves to an unintended upstream)
- An issue in the CI workflows or wrapper reusables
- An issue in the test harness or build tooling
- An issue affecting any user of the registry (e.g. a manipulated
Versions.tomlthat downstream resolvers would interpret unsafely)
Vulnerabilities in registered packages themselves are out of scope for this repo — report them to the package's own upstream. (We will, however, yank an affected version from the registry if a coordinated disclosure requires it; open an issue tagged yank once the embargo has lifted.)
This repo runs the full estate-standard scanning fleet on every push to main:
- CodeQL (GitHub Actions surface)
- OpenSSF Scorecard
- Hypatia neurosymbolic CI/CD scan
- Secret scanner (gitleaks)
- Governance checks (banned languages, banned patterns, SPDX, RSR)
Findings appear in the Security tab of the repo. The 2026-05-27 sweep brought the open-alert count to zero except for an in-flight feature-branch policy artefact.
Some historical alerts originated in Hypatia's own meta-rules (CSA001/CSA002/CSA003) — these were dismissed against hyperpolymath/hypatia#368, which suppresses the self-echo at the SARIF render layer.