54 lines
1.7 KiB
Markdown
54 lines
1.7 KiB
Markdown
|
# Security Policy
|
||
|
|
|
||
|
|
## Supported Versions
|
||
|
|
|
||
|
|
| Version | Supported |
|
||
|
|
|---|---|
|
||
|
|
| 1.0.x | yes |
|
||
|
|
| < 1.0 | no |
|
||
|
|
|
||
|
|
## Trust Model
|
||
|
|
|
||
|
|
Imhotep is a test framework. It runs with the privileges of the invoking test process.
|
||
|
|
|
||
|
|
Primary trust boundaries:
|
||
|
|
|
||
|
|
1. Node test process (full local process privileges)
|
||
|
|
2. Playwright browser context (page JavaScript execution)
|
||
|
|
3. CDP extraction channel (local browser debugging protocol)
|
||
|
|
|
||
|
|
## Execution Safety Posture
|
||
|
|
|
||
|
|
- No dynamic `eval`/`new Function` based execution for assertions.
|
||
|
|
- Assertions are compiled to structured representations (AST/IR/FOL), then evaluated.
|
||
|
|
- Runtime extraction diagnostics fail closed instead of silently passing unsupported cases.
|
||
|
|
|
||
|
|
## CDP Constraints
|
||
|
|
|
||
|
|
- CDP usage is intended for local Playwright sessions.
|
||
|
|
- Extraction is read-oriented (DOM/CSS/layout facts) with temporary correlation attributes removed after use.
|
||
|
|
- No built-in remote debugger dialing behavior is provided by framework defaults.
|
||
|
|
|
||
|
|
## User-Supplied Code Risks
|
||
|
|
|
||
|
|
The following run as trusted code and must be treated accordingly:
|
||
|
|
|
||
|
|
- custom renderer adapters
|
||
|
|
- custom predicates/evaluators
|
||
|
|
- fixture pages loaded in browser contexts
|
||
|
|
|
||
|
|
Do not run untrusted fixtures, renderers, or test helpers in privileged environments.
|
||
|
|
|
||
|
|
## Data Sensitivity
|
||
|
|
|
||
|
|
Imhotep outputs may include selectors, text labels, geometry, and diagnostics.
|
||
|
|
|
||
|
|
- Treat logs/artifacts as potentially sensitive in CI.
|
||
|
|
- Redact or avoid committing environment-specific secrets captured by test harness code.
|
||
|
|
|
||
|
|
## Vulnerability Reporting
|
||
|
|
|
||
|
|
Open a GitHub issue labeled `security` for non-sensitive reports.
|
||
|
|
|
||
|
|
If disclosure should be private first, include "PRIVATE SECURITY REPORT" in the issue title and avoid posting exploit details until maintainers respond.
|