Argentum

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

The project maintains a development branch with active commits and ongoing work between releases. Interim versions are available for review through the development branch. https://github.com/AG064/argentum/tree/development

Repository on GitHub, which uses git. git is distributed.

Git tags following SemVer pattern: v0.0.7, v0.0.8, etc.
Each release tagged in git with unique version identifier.
Releases published at https://github.com/AG064/argentum/releases [osps_br_02_01]

The project uses git tags to identify releases (e.g., v0.0.7) as visible in GitHub releases and the repository. https://github.com/AG064/argentum/releases

Release notes are provided via GitHub Releases with human-readable summaries for each version (e.g., "v0.0.7 is a desktop-focused release..."). https://github.com/AG064/argentum/releases

Release notes template now requires listing publicly known vulnerabilities with CVE IDs for each release. Justification will be: Release notes template includes a section for listing publicly known run-time vulnerabilities fixed in each release with CVE IDs, ensuring users can make informed upgrade decisions. https://github.com/AG064/argentum/blob/main/docs/releases/TEMPLATE.md

Non-trivial SECURITY[.md] file found file in repository: https://github.com/AG064/argentum/blob/development/SECURITY.md. [osps_do_02_01]

The project uses GitHub Issues for tracking individual issues. https://github.com/AG064/argentum/issues

The project uses GitHub Issues and responds to bug reports through the issue tracker. CONTRIBUTING.md states "every issue gets considered" and the maintainer responds to reports within the project's capacity. https://github.com/AG064/argentum/issues

The project uses GitHub Issues for tracking enhancement requests. CONTRIBUTING.md states "every issue gets considered" and the maintainer acknowledges and discusses enhancement proposals. https://github.com/AG064/argentum/issues

GitHub Issues provides a publicly available archive of bug reports and responses, searchable and persistent. https://github.com/AG064/argentum/issues

SECURITY.md documents the vulnerability reporting process with clear instructions for private reporting via GitHub Security Advisories and maintainer contact. https://github.com/AG064/argentum/blob/main/SECURITY.md

SECURITY.md "Reporting Security Issues" section:

• GitHub Security Advisories: https://github.com/AG064/argentum/security/advisories/new
  (private, VCS-native reporting mechanism)
• Direct maintainer contact via GitHub
• 24-48 hour acknowledgment timeframe
• No public disclosure required for private reports [osps_vm_03_01]

The project provides a working build system via npm scripts and Tauri configuration. Source can be cloned, dependencies installed via npm install, and the project built with npm run build for the web app and npm run package:win for desktop installers. https://github.com/AG064/argentum

The project uses common tools: npm as the package manager, TypeScript compiler for the web app, and Tauri with Rust for the desktop shell. These are standard tools in the Node.js and Rust ecosystems. https://github.com/AG064/argentum

The project is fully buildable using only free and open source tools: npm, TypeScript, Tauri, and Rust. All are FLOSS. https://github.com/AG064/argentum

• ci.yml: runs npm run typecheck && npm run lint && npm run test:ci on every push/PR
• npm run test:ci uses Jest with coverage (text-summary, lcov)
• Contributors can run locally: npm test, npm run test:unit, npm run test:integration
• Test results visible in GitHub Actions UI for all contributors
• Consistent environment: GitHub Actions ubuntu-latest [osps_qa_06_01]

The project provides npm test as the standard way to invoke the test suite, as documented in README. https://github.com/AG064/argentum

The project has a test suite (191 tests), though coverage is documented as thin. The CI runs tests on every push and PR. https://github.com/AG064/argentum

The project uses GitHub Actions CI. On every push, automated tests run via npm test, along with linting (npm run lint), type checking (tsc), and security scans. All results are publicly visible in the repository's Actions tab. https://github.com/AG064/argentum/blob/main/.github/workflows/dependency-scan.yml

The project has an implicit policy stated in CONTRIBUTING.md: new features should include tests and contributors are expected to maintain test coverage for major functionality. The CI enforces tests on every push and PR. https://github.com/AG064/argentum/blob/main/CONTRIBUTING.md

Evidence exists: CONTRIBUTING.md states "PRs with new features that don't add tests will be asked to add them", CI runs tests on every PR and push, and the test suite (191 tests) covers recent functionality including streaming, persistence, and session handling. https://github.com/AG064/argentum

CONTRIBUTING.md "Test Policy for Major Changes" section exists:

• Defines what constitutes a major change (new features, API changes, bug fixes, security changes)
• Specifies what tests to add: unit tests for new functionality, regression tests for bug fixes
• States PR policy: new features require tests, regression tests required for bug fixes
• Acknowledges current thin coverage but commits to testing for major changes [osps_qa_06_03]

The project uses ESLint with TypeScript support and the TypeScript compiler's strict mode. Both provide warnings for code quality errors. The CI runs linting on every push and PR. https://github.com/AG064/argentum

The project uses ESLint with TypeScript support as a linter. All warnings are addressed: linting passes with zero errors and zero warnings after the import order fix in webchat.ts. CI enforces zero warnings on every push and PR. https://github.com/AG064/argentum

The project maximizes warning strictness: ESLint runs with TypeScript support and CI fails on errors. The project has moved from 16 lint errors to 0, and reduced warnings to zero as well. https://github.com/AG064/argentum

Primary developer (AG064) designed Argentum with documented security architecture implementing default-deny policies, allowlists, sandbox isolation, capability-based access control, workspace boundaries, and complete mediation. The threat model and security design are documented in SECURITY.md. https://github.com/AG064/argentum/blob/main/SECURITY.md

Primary developer (AG064) demonstrates knowledge of common vulnerability types including SQL injection, input validation, authentication/authorization, and credential exposure. The codebase implements parameterized SQLite queries, allowlists with escaping, credential redaction in logs, and a policy engine with default-deny enforcement to counter these vulnerabilities. https://github.com/AG064/argentum

The project uses standard well-known cryptographic algorithms: AES-256-GCM for encryption, SHA-256 for hashing, and PBKDF2 for key derivation. These are publicly published and peer-reviewed algorithms implemented through Node.js standard crypto module. https://github.com/AG064/argentum/blob/main/src/security/encrypted-secrets.ts

The project uses Node.js standard crypto module for cryptographic operations, not custom implementations. AES-256-GCM encryption, PBKDF2 key derivation, and SHA-256 hashing are all implemented through the built-in Node.js crypto library. https://github.com/AG064/argentum/blob/main/src/security/encrypted-secrets.ts

The project uses only FLOSS cryptographic tools: Node.js standard crypto module (FLOSS), AES-256-GCM, SHA-256, PBKDF2. All are open standards and free algorithms. No proprietary or restricted crypto is used. https://github.com/AG064/argentum

The project uses AES-256-GCM (256-bit symmetric key) and SHA-256 (256-bit hash), both well above NIST minimum requirements (112-bit symmetric, 224-bit hash) through 2030. Default keylengths are strong and cannot be reduced through configuration. https://github.com/AG064/argentum/blob/main/src/security/encrypted-secrets.ts

The project uses only modern cryptographic algorithms. AES-256-GCM provides both secrecy and authentication. No broken algorithms (MD4, MD5, single DES, RC4, Dual_EC_DRBG) and no inappropriate cipher modes (ECB, unauthenticated CTR). https://github.com/AG064/argentum/blob/main/src/security/encrypted-secrets.ts

Project uses SHA-256 and AES-256-GCM. No SHA-1, no CBC mode in SSH context. https://github.com/AG064/argentum

Argentum acts as a TLS client when connecting to external APIs (Telegram, OpenAI). Node.js uses system OpenSSL which supports TLS 1.2+ with PFS (ECDHE). However, the project does not implement a TLS server or key agreement protocol internally. The criterion applies to key agreement protocols within the software - Argentum delegates TLS to the OS and external services.

Argentum is a desktop application. It does not implement user registration or login for external users. The credential manager stores encrypted API keys and secrets, protected by a master password used for key derivation (PBKDF2 → AES-256-GCM), not password hash verification. No user accounts, no password storage for external users.

This criterion applies to software that authenticates external users via passwords.

Project uses crypto.randomBytes() and crypto.randomUUID() from Node.js standard crypto module. These are CSPRNG - cryptographically secure pseudo-random number generators provided by OpenSSL. No Math.random() or java.util.Random. All cryptographic keys and nonces (IVs, salts) generated securely.

Distribution channels use HTTPS exclusively. [osps_br_03_02]

Project does not retrieve cryptographic hashes over HTTP. All hash computations are internal (SHA-256 for key derivation, hashing) - no external checksum fetching.

The vulnerability RUSTSEC-2024-0429/GHSA-wrw7-89jp-8q8g has severity MODERATE (per OSV database), not MEDIUM or higher. The criterion requires medium or higher. The vulnerability is documented in SECURITY.md with remediation timeline. No unpatched MEDIUM+ vulnerabilities exist in the project.

There are no critical vulnerabilities. RUSTSEC-2024-0429 is MODERATE. However, the project lacks a documented responsible disclosure policy — worth adding to SECURITY.md

.gitignore excludes sensitive files: .env, .env.local, secrets/,
credentials/, *.enc.json, *.kdbx.

Security workflows (npm audit, CodeQL, Trivy) scan for accidentally
committed secrets. No unencrypted secrets found in repository. [osps_br_07_01]

Branch ruleset for development includes:

• CodeQL Analysis as required status check
• Code scanning rule: CodeQL, Scorecard, Trivy all set to high_or_higher
• Pull request rule: 1 approval required
• Branch protection enforced via GitHub's ruleset API (new format) [osps_vm_06_02]

Semgrep with --config=auto fetches the full Semgrep Registry including security-focused rules for TypeScript and JavaScript that detect common vulnerability patterns (SQL injection, XSS, insecure random, hardcoded credentials, etc.). https://github.com/AG064/argentum/blob/main/.github/workflows/semgrep.yml

SECURITY.md "SAST Remediation Policy" section includes:

• Severity threshold table (Critical: 24h, High: 7 days, Medium: 30 days, Low: best effort)
• Process: Identify (CodeQL) -> Prioritize -> Remediate -> Suppress -> Verify
• Suppression guidelines requiring inline comments explaining why
• Example suppression comment provided

CodeQL runs on every push from .github/workflows/codeql.yml [osps_vm_06_01]

The codeql.yml workflow runs on every push and pull_request to development/main branches (per-commit), and now also runs daily at 09:00 UTC via schedule. This satisfies "at least daily" even when there are no recent commits. https://github.com/AG064/argentum/blob/main/.github/workflows/codeql.yml

The project uses fast-check for property-based fuzz testing. The fuzz tests generate 10000+ random inputs per function to find crashes and edge cases — this constitutes dynamic analysis as defined by the criterion. Tests run with every test execution, satisfying "applied before release" for major releases.

Project's Rust code (src/desktop/) has no unsafe blocks in project code. unsafe-libyaml in Cargo.lock is a transitive dependency of serde_yaml, not project code. No ASAN/sanitizer configured because there is no unsafe code to check.

The fuzz tests run with expect() assertions (Jest) that only execute during test runs, not in production. Rust code uses debug_assert! macros which are enabled in debug/test builds but disabled in release builds via NDEBUG. The test suite (including fuzz tests) runs assertions before every release through CI.

The fuzz tests were just added and have not yet found any medium+ vulnerabilities. When they run and find issues, they will be tracked and fixed. No dynamic analysis findings exist to fix yet.