Imhotep/SECURITY.md

# Security Policy

## Supported Versions

| Version | Supported |
|---|---|
| 1.1.x | yes |
| < 1.1 | no |

## Trust Model

Imhotep is a test framework. It runs with the privileges of the invoking test process.

Primary trust boundaries:

1. Node test process (full local process privileges)
2. Playwright browser context (page JavaScript execution)
3. CDP extraction channel (local browser debugging protocol)

## Execution Safety Posture

- No dynamic `eval`/`new Function` based execution for assertions.
- Assertions are compiled to structured representations (AST/IR/FOL), then evaluated.
- Runtime extraction diagnostics fail closed instead of silently passing unsupported cases.

## CDP Constraints

- CDP usage is intended for local Playwright sessions.
- Extraction is read-oriented (DOM/CSS/layout facts) with temporary correlation attributes removed after use.
- No built-in remote debugger dialing behavior is provided by framework defaults.

## User-Supplied Code Risks

The following run as trusted code and must be treated accordingly:

- custom renderer adapters
- custom predicates/evaluators
- fixture pages loaded in browser contexts

Do not run untrusted fixtures, renderers, or test helpers in privileged environments.

## Data Sensitivity

Imhotep outputs may include selectors, text labels, geometry, and diagnostics.

- Treat logs/artifacts as potentially sensitive in CI.
- Redact or avoid committing environment-specific secrets captured by test harness code.

## Vulnerability Reporting

To report a security vulnerability, open an issue on the Gitea repository labeled `security`.

For private disclosure, email `security@imhotep.dev`. Include the affected package, version, and a description of the issue. Maintainers will respond within 5 business days.