Skip to content

SECURITY.md

Latest commit

 

History

History
169 lines (122 loc) · 4.46 KB

SECURITY.md

File metadata and controls

169 lines (122 loc) · 4.46 KB

Security Policy

Supported Versions

We provide security updates for the following versions:

Version Supported
1.0.x ✅
< 1.0 ❌

Reporting a Vulnerability

If you discover a security vulnerability in C Lumen, please report it responsibly:

  1. DO NOT create a public issue
  2. Email security details to: security@c-lumen.dev
  3. Include:
    • Description of the vulnerability
    • Steps to reproduce
    • Potential impact
    • Suggested fix (if any)

We will respond within 48 hours and provide regular updates on our progress.

Security Features

Unicode Security

C Lumen implements several Unicode security measures:

1. NFC Normalization

  • All input is normalized to Unicode NFC form
  • Prevents canonicalization attacks
  • Ensures consistent processing

2. Bidirectional Override Detection

  • Rejects Unicode bidi overrides (\u202A-\u202E, \u2066-\u2069)
  • Prevents text direction attacks
  • Fails fast on suspicious input

3. Confusable Character Detection

  • Detects visually similar characters
  • Warns about potential spoofing attacks
  • Optional --allow-mixed-script for controlled environments

Input Validation

  • File Type Validation: Only processes .clumen.c and .clumen.cpp files
  • Encoding Validation: Ensures UTF-8 input
  • Size Limits: Reasonable limits on file size and token count
  • Path Validation: Prevents directory traversal attacks

Output Safety

  • Deterministic Output: Same input always produces same output
  • Source Maps: Enable precise error reporting without exposing internals
  • No Code Execution: Never executes user code
  • Sandboxed Processing: Isolated tokenization and mapping

Threat Model

What C Lumen Protects Against

  1. Unicode Attacks

    • Canonicalization attacks
    • Bidirectional text attacks
    • Confusable character attacks

  2. Input Validation Attacks

    • Malformed input handling
    • Path traversal attempts
    • Resource exhaustion

  3. Output Integrity

    • Deterministic processing
    • Source map accuracy
    • No information leakage

What C Lumen Does NOT Protect Against

  1. Compilation Security

    • C Lumen only translates keywords
    • Compiler security is outside our scope
    • Use secure coding practices

  2. Runtime Security

    • Generated code security depends on developer practices
    • Memory safety is compiler/runtime responsibility

  3. Build System Security

    • CMake integration security
    • CI/CD pipeline security

Security Best Practices

For Developers

  1. Validate Inputs

    # Always validate file types
clumen apply --lang es --in file.clumen.c --out file.c

  2. Use Source Maps

    # Generate source maps for debugging
clumen apply --lang es --in file.clumen.c --out file.c --sourcemap file.map.json

  3. Enable Confusable Detection

    # Use strict mode (default)
clumen apply --lang es --in file.clumen.c --out file.c

# Only allow mixed scripts when necessary
clumen apply --lang es --in file.clumen.c --out file.c --allow-mixed-script

For Build Systems

  1. Verify Output

    # Always verify translations
clumen verify --ci

  2. Use Canonical Sources

    • Only compile canonical .c/.cpp files
    • Never commit localized source files
    • Use source maps for debugging

Security Updates

Security updates are released as soon as possible after discovery and fix. We follow this process:

  1. Immediate Response (0-24 hours)

    • Acknowledge vulnerability report
    • Assess severity and impact
    • Begin investigation

  2. Fix Development (1-7 days)

    • Develop and test fix
    • Coordinate with security team
    • Prepare release

  3. Release (1-14 days)

    • Release security update
    • Notify users via GitHub security advisories
    • Update documentation

Security Audit

C Lumen undergoes regular security audits:

  • Code Review: All changes reviewed for security implications
  • Dependency Scanning: Regular updates of security-critical dependencies
  • Penetration Testing: Periodic security testing
  • Third-Party Audits: External security reviews

Contact

  • Security Issues: security@c-lumen.dev
  • General Questions: Open a GitHub issue
  • Public Discussion: GitHub Discussions

Acknowledgments

We thank the security researchers who help keep C Lumen secure through responsible disclosure.