Security policy

Reporting a vulnerability

Report privately through GitHub's advisory form. Please do not open a public issue first. This is a personal project maintained in evenings, so expect an acknowledgement within a week.

What the tool does, and does not do

Rulebearing reads source files, compiled assemblies and configuration, and writes reports. Its security posture is described in docs/architecture.md and is deliberately narrow:

• No network. The binary makes no outbound connection.
• No code execution outside a sandbox. A JavaScript configuration file, and a plugin:<path> reporter, runs in an embedded QuickJS interpreter with no filesystem access beyond the repository, no network, no process and no timers (ADR-0006, docs/reporters.md § Plugin reporters). The repository is the nearest folder above the working directory with a .git, else the working directory; the sandbox refuses to run when that would be the filesystem root or the home directory. Node is spawned only with --sidecar node or --config-via-node, and the report records that it was: summary.sidecar names the dependency-cruiser the sidecar ran and how many files it extracted, and optionsUsed.viaNode marks a configuration Node evaluated. Both run Node with an argument vector, never through a shell.
• The --cache folder is trusted. A cached run reports from the entry it finds when the entry's key matches, so a forged entry can make a gate pass. The folder (.graph/cache by default) must stay private to the machine that wrote it: never commit it, and never restore it from a cache that another branch, fork or pull request could have written (docs/cli.md § The cache). A damaged entry is a miss and every file of one is read under a size limit, but the cache does not defend against an entry written to deceive it.
• Untrusted input. Assemblies, portable PDBs, source files and configuration are parsed defensively. A malformed input must produce exit code 2 with a named reason, never a panic. Fuzz targets cover the metadata reader and the configuration parsers.

A sandbox escape, a network connection, a panic on malformed input, or a path traversal out of the repository is a vulnerability. A rule that produces a wrong finding is a bug; please open an issue for it.

Supported versions

Until version 1.0, only the latest release receives fixes.