Security policy

Security policy

SECURITY.md is the repository’s security policy, and Lint & docs holds it to a budget of 900 words.

Reporting a vulnerability

SECURITY.md asks for a report through GitHub’s private vulnerability reporting for lmodel/oscal, not through a public issue or a pull request.¹ A report says which file is affected, how it is exploitable, and whether it reaches the released schema or only the repository’s automation. One person maintains the repository, so a first reply comes in days, not hours, and there is no bounty.

Supported versions

Only the latest release receives fixes. A security fix is released as a patch and noted in CHANGELOG.md. The schema stays below 1.0.

What the repository releases

The repository releases a LinkML schema, the Python datamodel generated from it, and the schema’s lokf adapt copy as a release asset. Nothing is published to PyPI. scripts/check_upstream_release.py runs only in Upstream watch. It reads usnistgov/OSCAL’s latest release and the pinned tree listing, and writes nothing but its report. The tests parse the metaschema copy with the standard library’s XML parser, writing in its shared-constraint files as text, so no external entity is resolved. SECURITY.md adds that a schema is data: loading one from an untrusted source with any LinkML tool is that tool’s risk, not this repository’s.

What holds each surface

• Build and test and Lint & docs on every pull request, and Knowledge Registrar on any pull request that touches .lokf/, run read-only jobs with persist-credentials: false, and uv sync --locked installs only what uv.lock pins.
• Semantic release pushes a changelog commit and a tag to main and dispatches the knowledge release. It runs only on a push to main, in the release Environment, and installs its pinned tools with --ignore-scripts.
• Knowledge website builds without a write token. Only its deploy job holds pages: write and id-token: write, and that job runs only from main, once KNOWLEDGE_WEBSITE_ENABLED is true.
• Upstream watch runs weekly with a read-only checkout, and its one write scope, issues: write, opens or updates the finding’s issue.
• Knowledge Librarian and .lokf/scripts/, copies of the ktl-sidecar template, run an LLM agent on a schedule. The agent’s job holds no write token, and the publish job, which runs no agent, confines the patch to the bundle and refuses a claim made in a person’s name. A person merges the pull request. It is inert until KNOWLEDGE_LIBRARIAN_ENABLED is true.
• Knowledge Release attaches the schema copy and the bundle to a release. It is inert until dispatched, and only its attach job, which runs no third-party packages, can write.
• The README, llms.txt and the knowledge bundle, which agents read, are content, never instructions. A confirmation in a person’s name must be backed by a review or a signed commit.

SECURITY.md says that every workflow declares permissions: {} at the top, pins its actions to commit SHAs that Dependabot keeps current, and runs harden-runner in audit mode. .github/dependabot.yml asks Dependabot for monthly updates of the workflows’ GitHub Actions, grouped into one pull request.²

Settings not yet in force

Three protections are repository settings, not files, and SECURITY.md says that they are not yet in force here: required reviewers on the release Environment, a rule that blocks deletion and force-pushes on main, and secret scanning with push protection. Until they are, a qualifying merge releases with no human step. Nothing in CI can assert them, so keeping them on is the maintainer’s job.

Not covered

• OSCAL itself, and the metaschema copied under src/oscal/schema/metaschema/: a problem in OSCAL goes to NIST;
• LinkML, its generators and its runtime, which go to LinkML;
• a compromised runner, upstream action or agent harness, since the policy is a baseline, not a sandbox, though a finding in one is still welcome, with its scope and a reproduction;
• whether the knowledge bundle is true: the gate proves who vouched, not what they read, and AI_COVENANT.md sets the rules of human accountability.

Footnotes

1. SECURITY.md, every section ↩

2. .github/dependabot.yml, the updates list ↩