From 77f8297aec39cfcd34a46fb84639291c4f572ab5 Mon Sep 17 00:00:00 2001 From: OmarAlJarrah Date: Tue, 10 Nov 2026 23:41:50 +0300 Subject: [PATCH] docs: add a security policy The security label tells reporters to see SECURITY.md for private reports, and no such file existed. Add one at the root. It names GitHub's private vulnerability reporting as the channel, says only main's latest commit is supported while Morphic has no release, and draws the trust line the README's bounds imply: the spec and every document it references are untrusted, while the caller's options and code are not. Input that gets past a bound, by reading a file or URL it should not, or by crashing or exhausting the process instead of ending in a diagnostic, is a vulnerability. With allow-external-refs set the spec is trusted to name what it reads, but a document fetched over the network still is not. --- SECURITY.md | 53 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..b86c1b91 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,53 @@ +# Security policy + +## Reporting a vulnerability + +Report a vulnerability privately, through GitHub's +[private vulnerability reporting](https://github.com/dexpace/morphic/security/advisories/new): on +the repository's **Security** tab, choose **Report a vulnerability**. Do not open a public issue or +pull request about it. The report opens a draft advisory that only you and the maintainers can +read, and it is followed up with you there. + +A report is quickest to act on when it gives: + +- the Morphic commit you ran; +- the command or library call, with the options it set; +- the smallest spec that reproduces the problem, with every document the spec references; +- what happened, and what you expected instead. + +If you are unsure whether something is a vulnerability, report it privately anyway. + +## Supported versions + +Morphic has no released version yet. Fixes land on `main`, so only its latest commit is supported: +check that a report reproduces there. + +## Scope + +Morphic treats the spec it compiles, and every document the spec references, as untrusted. It +trusts what its caller supplies: the options, a file an option names (an overlay), and the code a +[library](README.md#library) caller hands it, such as a compiler, a pass or a cache. + +The [README](README.md#design-principles) states the bounds Morphic holds untrusted input to: + +- Unless `allow-external-refs` is set, a `$ref` reads only regular files inside the spec's + directory, through relative references. An absolute path, a `file:` URI, a URL and a symbolic + link out of the directory are each refused. +- [Budgets](README.md#compiler-options) on what a document or a compile may cost turn a + pathological document into a diagnostic instead of an exhausted host. + +A vulnerability is untrusted input that gets past one of these bounds: a spec that makes Morphic +read a file or reach a URL it should have refused, or a document that crashes the process, runs +without end or exhausts its memory instead of ending in a diagnostic. + +Setting `allow-external-refs` says the spec is trusted to name the files and URLs it reads, so set +it only for a spec you trust. A document fetched over the network stays untrusted: one that makes +Morphic read a local file is a vulnerability. + +Two things are not vulnerabilities. What a document costs under a budget the caller raised or +turned off is the caller's choice. Wrong or lossy IR for a valid spec is a bug: open a +[public issue](https://github.com/dexpace/morphic/issues) for it. + +A weakness already filed under the +[`security` label](https://github.com/dexpace/morphic/issues?q=label%3Asecurity) is known and +public, so add to that issue rather than reporting it again.