mirror of
https://github.com/kellymichels/zscripts-token-savers
synced 2026-10-07 07:18:18 +00:00
Kelly Michels
573e01021b
Defers to the org policy for how to report and covers what is particular to a repository that is a sanitised mirror: the most valuable report here is not a crash, it is something REAL that should not be here - a credential, an internal hostname, an operator path, an identifier naming a private project. Mail those rather than filing an issue, because a public issue about a leaked secret publishes it a second time. It also says what the automated check is and is not. The sanitisation suite is a DENYLIST: it proves the absence of known patterns, not the absence of secrets. Green tests are why a human report is still worth sending. And the ordinary warning for what these actually are - automation that archives a tree, uploads it, rebuilds containers and restarts services. Read before running, nothing here is a sandbox, the config is yours to replace. TWINS ARE NOW DISCOVERED, NOT LISTED. PAIRS was hand-kept and two files had outgrown it: ELEVATOR_PITCH.md and TOKEN_SAVINGS.md had no twin at all. Adding a document and remembering to add it to a list are two acts, and the second is the one that gets skipped. The Pester test had the same shape in reverse - it scraped PAIRS out of the generator's source, so it could only prove the list was self-consistent and a document nobody listed was invisible to it. It now asks the REPOSITORY what markdown it has. Proven by deleting SECURITY.txt and watching two tests fail. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
69 lines
3.2 KiB
Markdown
69 lines
3.2 KiB
Markdown
# Security
|
|
|
|
How to report a vulnerability, what to expect, and what is in scope:
|
|
**[the evomedia-net security policy](https://github.com/evomedia-net/.github/blob/main/SECURITY.md)**.
|
|
Short version — email [dev@evomedia.net](mailto:dev@evomedia.net), not a public
|
|
issue.
|
|
|
|
What follows is particular to this repository, which is unusual in one way
|
|
worth stating plainly.
|
|
|
|
## This is a mirror, and the interesting bug is a leak
|
|
|
|
These scripts are published from a private tree. The copy here is sanitised:
|
|
placeholder hosts, example configuration, dummy data. So the most valuable
|
|
thing anyone can report about this repository is not a crash — it is
|
|
**something real that should not be here**:
|
|
|
|
- a credential, key, token, or private-key block
|
|
- an internal hostname, a product domain, or an operator's path
|
|
- an identifier that names a private project or a private-only script
|
|
|
|
If you find one, treat it as a live secret and mail
|
|
[dev@evomedia.net](mailto:dev@evomedia.net) rather than opening an issue. A
|
|
public issue about a leaked secret publishes it a second time and pins it to
|
|
the top of the page.
|
|
|
|
**The automated check is a denylist.** `tests/Sanitization.Tests.ps1` and
|
|
`tests/sanitization-patterns.psd1` hold the patterns this repository must never
|
|
contain, and CI enforces them. A denylist proves the absence of *known*
|
|
patterns, not the absence of secrets — it is a regression net for a specific
|
|
recurring mistake, not a substitute for reading what is published. That is why
|
|
a report here is worth sending even though the tests are green.
|
|
|
|
## They are automation scripts, so read them before running them
|
|
|
|
Everything here drives real infrastructure: archives a working tree, uploads
|
|
it, rebuilds containers, restarts services. That is the purpose, and it means
|
|
the ordinary rules for running someone else's shell scripts apply with more
|
|
force than usual.
|
|
|
|
- **Read a script before the first run**, and run it against something you can
|
|
afford to break.
|
|
- **Nothing here is a sandbox.** There is no dry-run guarantee unless a script
|
|
documents one; the flag that exists on one command may not exist on the next.
|
|
- **The configuration is yours.** The example config carries placeholders, and
|
|
every host, key path and target in it has to be replaced with your own before
|
|
anything is pointed at real infrastructure.
|
|
- Addresses in examples use the ranges reserved for documentation, and
|
|
loopback. They are placeholders, not somewhere to send anything.
|
|
|
|
Scripts that destroy or overwrite state are the ones to read twice. A report
|
|
that one of them does something destructive **without saying so** is a good
|
|
report; a report that a script named after a destructive act performs it is
|
|
not.
|
|
|
|
## Release integrity
|
|
|
|
Releases carry checksums. They are an **integrity check, not a signature** —
|
|
they catch a truncated download, a corrupted mirror and an accidental edit,
|
|
and they do not catch a forger, because whoever can change an archive can
|
|
change the manifest that travels with it.
|
|
|
|
## Not a finding here
|
|
|
|
- **Placeholder credentials and example configuration.** Fake values are the
|
|
sanitisation working, not a leak.
|
|
- **The private tree.** Only what is published here is in scope; the internal
|
|
original is not public and cannot be reviewed.
|