Skip to main content

Security

The policy — how to report a vulnerability, what is in scope, what the supported versions are, and the table of controls with the reading behind each one — is SECURITY.md at the repository root. It lives there because that is where GitHub looks for it and where a reporter arriving at the repository will find it; this section is not a second copy.

What this section holds is the engineering policy the adapters are held to:

  • Parser safety — the five configurable bounds and where they live, the rules for XML, archives and SQLite, and the audit of every parser call in all thirty shipped adapters.
  • Supply chain — the provenance chain from a commit to an attested artefact, the job that realises each arrow, what each of the six scanners is blind to, and the exception mechanism that is the one way past a blocking finding.
  • Release pipeline — the jobs a tag push runs, the five conditions a release must meet, the lint stage's rule set, and what the pipeline does not cover.
  • Deployment envelope — what bounds untrusted input in the library, what the conformance worker isolates and on which platforms, what stays the hosting application's job, and the two things this package does not do: stream, and verify integrity.

The figures those pages rest on — the worker's deadlines, the declared bounds, the version axes — are rendered on the Current contracts page from the package itself.

Two things stated here so they are not inferred​

The package makes no network call. No telemetry, no licence check, no remote registry, no update ping. tests/test_cdm_no_network.py proves it statically over every module and again by removing socket.socket and running the whole conformance sweep underneath. The claim is about this package's own code and not about its dependencies.

Nothing here is signed. The CDM carries no signature, no MAC and no integrity token, and the translation layer is forbidden from importing a cryptographic primitive at all. That is a deliberate absence with a recorded reason, not an omission — a consumer who needs provenance they can verify cryptographically does not have it here today.