If you discover a security vulnerability in elm-wrap, please report it responsibly.

Use GitHub's private vulnerability reporting to submit your report. This keeps the details confidential until a fix is available.

Email: damir@oomm.dev

Please include:

• A description of the vulnerability
• Steps to reproduce the issue
• Any relevant proof-of-concept code
• Your assessment of the potential impact

• Acknowledgment: Within 48 hours
• Initial assessment: Within 7 days
• Fix timeline: Depends on severity, typically within 30 days for critical issues

1. We will acknowledge your report promptly
2. We will investigate and keep you informed of our progress
3. We will credit you in the security advisory (unless you prefer anonymity)
4. We will coordinate disclosure timing with you

All release binaries are signed using Sigstore and recorded in the public Rekor transparency log. This provides tamper-evident provenance: you can verify that a binary was built by our GitHub Actions workflow and hasn't been modified.

# Download the binary and verify its attestation
gh attestation verify elm-wrap-macos-arm64 --owner dsimunic

# Verify with cosign (requires the binary's SHA256)
cosign verify-blob-attestation \
  --new-bundle-format \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  --certificate-identity-regexp="^https://github.com/dsimunic/elm-wrap/" \
  elm-wrap-macos-arm64

Each release includes a SHA256SUMS file and individual .sha256 files:

# Verify checksum
sha256sum -c elm-wrap-macos-arm64.sha256

This project follows secure coding practices documented in doc/writing-secure-code.md. Key practices include:

• Mandatory use of bounded memory allocations (arena allocator)
• Input size limits enforced via compile-time constants
• No use of unsafe string functions (strcpy, sprintf, etc.)
• Compiler hardening flags: -Wall -Werror -Wunused-result

elm-wrap processes untrusted input from:

• elm.json files in user projects
• Package metadata from Elm package registries
• Custom registry configurations

All inputs are validated and bounded. See doc/security-hardening.md for our threat model and ongoing hardening efforts.