From 0a349f5a3475d2e75b3b047b9eb12a35a07285b4 Mon Sep 17 00:00:00 2001 From: Michael D'Angelo Date: Tue, 11 Aug 2026 14:14:14 -0700 Subject: [PATCH] docs(security): clarify local trust and reportable boundaries --- SECURITY.md | 61 +++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 43 insertions(+), 18 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index b2ca5bf7..3a839227 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -48,14 +48,24 @@ operations can use repository configuration, hooks, filters, attributes, credential helpers, worktrees, and executables on your `PATH`. These are not separate security boundaries. -The product also does not isolate users, tasks, repositories, or scan jobs -that share the same operating-system account, credentials, or local state. -Do not treat shared local state as a multi-user or multi-tenant system. +### Local trust and attacker prerequisites + +The product does not isolate users, tasks, repositories, or scan jobs that +share the same operating-system account, credentials, or local state. Do not +treat shared local state as a multi-user or multi-tenant system. + +Private Codex state, workbench databases, output directories, and resume +receipts are not separate security boundaries from your operating-system +account. A report that depends on changing them must show how an +attacker-controlled input reaches them through a supported workflow and +crosses a security boundary. Trusting a repository does not authorize unrelated actions. Repository -contents, model output, patches, service responses, and imported artifacts -are data. They are not permission to scan another target, expose a credential, -contact another destination, modify an unrelated file, or apply a patch. +contents, filenames, symlinks, model output, patches, service responses, and +imported artifacts are data. They do not authorize another target, a broader +scope, a different credential, an unrelated read or write, an unapproved +patch or network destination, a bypassed restriction, or a passing result for +incomplete coverage. ### How scans run @@ -79,7 +89,9 @@ environment credentials it needs. A security issue must cross a boundary the product actually provides: -- Scan only the selected target and write only to authorized output paths. +- Scan only the selected target and requested scope; write only to authorized + output paths. +- Honor explicitly selected credentials and documented cost controls. - Keep credentials, private source, and scan results out of model requests, logs, reports, and network destinations the operator did not authorize. - Apply the scan's actual filesystem and execution profile and respect host or @@ -100,6 +112,8 @@ Report reproducible issues in an official release, such as: independently enforced host, execution, filesystem, or network restriction. - A scan, patch, file write, or network request outside the action you authorized. +- Ignoring the target, path scope, credential, or documented cost limit you + explicitly selected. - Path traversal, a symlink, an archive, or a file-replacement race that writes outside the approved output or sends an unrelated local file to a model. - An incomplete, forged, or incorrectly scoped scan accepted as complete or as @@ -116,17 +130,28 @@ Report reproducible issues in an official release, such as: The following are not security vulnerabilities by themselves: - Reading selected repository files, resolving worktrees, running Git, or - using configured hooks, filters, credential helpers, and executables. -- An attack that first requires control of your trusted repository, local Git - installation, operating-system account, environment, or Codex state. -- A claim that depends on you intentionally selecting a malicious plugin, - interpreter, executable, credential, scan artifact, or override. -- Access, cancellation, modified results, or scan-history visibility between - processes that already share your operating-system account and local state. -- Prompt injection, unexpected model output, a missed finding, or a false - positive that does not cross an actual security boundary. -- A documented exclusion, ignore rule, soft cost limit, estimate, or Git - behavior accurately reflected in the scan and its results. + using configured hooks, filters, credential helpers, and executables within + the authority you granted. +- An attack that assumes prior control of your operating-system account, + trusted local Git settings, private Codex state, or private scan outputs + without showing how a supported input gains that control. +- A claim that depends on you deliberately granting a plugin, interpreter, or + executable the authority your account already has. +- Access, cancellation, or changes to private scan state, workbench databases, + results, resume receipts, or scan history by a process that already shares + your account and local state. +- Prompt injection, unexpected model output, missed findings, false positives, + or unsigned review receipts that do not cross a boundary or cause a supported + security gate to accept incomplete or misrepresented coverage. +- A documented exclusion, ignore rule, estimate, or Git behavior accurately + reflected in the scan and its results. +- Disclosed estimation uncertainty or unavoidable in-flight cost overruns + when an explicitly requested limit is still enforced as documented. +- Terminal formatting or control characters without a demonstrated security + impact in a supported terminal. +- A hypothetical compromise of a trusted release runner, registry, or + dependency supplier without a path from untrusted input to a protected + release or a bypass of its integrity controls. - A dependency advisory, theoretical attack, or old package version without a reproducible impact on a supported release. - Slow processing of a file, document, or repository you deliberately selected.