Fleet EDR

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

PRs are merged to main continuously between tagged releases; tags only mark release candidates. Dozens of PRs (#114-#280) merged between v0.1.0-rc.1 and v0.1.1-rc.1

Repository on GitHub, which uses git. git is distributed.

Every release has a unique SemVer tag, e.g. v0.1.0-rc.1, v0.1.0-rc.9, v0.1.1-rc.1. Tag list: https://github.com/getvictor/fleet-edr/tags.

Each release is identified by a git tag (e.g. v0.1.1-rc.1) at https://github.com/getvictor/fleet-edr/tags.

Every GitHub Release has auto-generated, human-readable notes listing the merged PRs with titles. Example: https://github.com/getvictor/fleet-edr/releases/tag/v0.1.1-rc.1. Notes are PR titles, not raw git log output.

No publicly known CVEs have been fixed in any release of this project to date. There are no advisories at https://github.com/getvictor/fleet-edr/security/advisories.

Non-trivial SECURITY[.md] file found file in repository: https://github.com/getvictor/fleet-edr/blob/main/SECURITY.md. [osps_do_02_01]

GitHub Issues at https://github.com/getvictor/fleet-edr/issues.

Maintainer responds to a majority of issues filed in the last 12 months; most receive an acknowledgment, label, or triage comment within days.

Maintainer responds to a majority of enhancement requests filed in the last 12 months.

GitHub Issues are publicly searchable and each issue is addressable by URL: https://github.com/getvictor/fleet-edr/issues.

SECURITY.md publishes the vulnerability reporting process: use GitHub private vulnerability reporting at https://github.com/getvictor/fleet-edr/security/advisories/new. SECURITY.md also documents required information, response SLA, and out-of-scope classes.

Private vulnerability reporting via GitHub Security Advisories: https://github.com/getvictor/fleet-edr/security/advisories/new. Creates an embargoed draft visible only to the maintainer and reporter.

SECURITY.md commits to acknowledging vulnerability reports within 2 business days. No vulnerability reports have been received in the last 6 months at time of submission.

Working build system via Taskfile.yml: task build builds everything, task build:server, task build:agent, task build:ui, task build:pkg build individual components. CI builds on every PR.

Standard tools: Go toolchain (go build), Node + Vite (npm run build) for the UI, Xcode + xcodebuild for the macOS extensions. All pinned in .tool-versions for reproducibility across local, CI, and AI-agent sandboxes.

Server and agent build with FLOSS tools only (Go stdlib, Node, golangci-lint, lefthook, task). The macOS system extension + network extension require Apple's proprietary SDK and code-signing toolchain, but those components are platform-bound. The server, which is what most deployers run, is FLOSS-buildable.

Automated test suite invoked with task test (full) or task test:go / task test:ui (targeted). Documented in CONTRIBUTING.md and run on every push and PR via .github/workflows/test.yml. Coverage is reported to SonarCloud and Codecov with an 80% new-code gate.

Tests are invoked via the language-standard runners: go test ./... (Go), npm test (UI), xcodebuild test (Swift). task test wraps all of them.

SonarCloud enforces Coverage on New Code ≥80% per PR; Codecov mirrors. Coverage is captured across server, agent, and UI (three Codecov flags). See codecov.yml and sonar-project.properties.

GitHub Actions runs the full test + lint matrix on every push and PR. Workflows: test.yml, go-lint.yml, ts-lint.yml, swift-lint.yml, c-lint.yml, md-lint.yml, openapi-lint.yml, arch-go.yml, codeql.yml, osv-scanner.yml, go-vulncheck.yml, scorecard.yml, zizmor.yml, actionlint.yml, and more.

CONTRIBUTING.md Tests section: "PRs that add code without adding tests will fail the gate." The SonarCloud 80% new-code coverage gate enforces this automatically. CLAUDE.md captures additional test-style policy (table-driven, no DB mocks in store tests, PBT for invariants).

Recent PRs demonstrate the policy in practice. For example, PR #278 was a pure UI test backfill, PR #279/#280 addressed SonarCloud findings including coverage. The Sonar gate is non-overridable on main, so every merged PR has met the new-code coverage threshold.

CONTRIBUTING.md "Tests" section is part of the change-proposal instructions; it links to docs/testing-strategy.md for the full seven-layer test pyramid.

Multi-language linter coverage: golangci-lint v2 with gosec, staticcheck, revive, errcheck, errorlint, nilaway, bodyclose, sqlclosecheck, noctx, depguard, forbidigo, testifylint, usetesting, modernize (see .golangci.yml). TypeScript: tsc --noEmit strict + ESLint with strictTypeChecked, eslint-plugin-security, eslint-plugin-no-unsanitized. Swift: swiftlint --strict. C bridge: clang-tidy. GitHub Actions: actionlint + zizmor.

All linters are gating CI jobs; warnings block merge to main. Suppressions require a one-line justification per CONTRIBUTING.md.

Strict mode enabled across languages: swiftlint --strict, TypeScript strictTypeChecked, golangci-lint with a deep ruleset, custom golangci-lint build with an in-tree commentwrap plugin for additional enforcement.

Primary developer (Victor Lyuboslavsky) has prior experience designing security-sensitive software. Specifically aware of: least privilege (auth-domain separation per route in main.go), secure defaults (TLS 1.3 default, HSTS with subdomain inclusion), fail-secure on auth errors, input validation at trust boundaries (event JSON parsing). Project ships a STRIDE threat model per component at docs/threat-model.md.

Primary developer aware of OWASP Top 10 classes (injection, auth bypass, XSS, CSRF, SSRF, broken access control) and applicable mitigations: parameterized SQL via database/sql throughout the server, output encoding via React for UI, CSRF tokens with constant-time compare on unsafe methods, HTTP-only Secure SameSite session cookies, bearer-token auth for agents, rate limiting on login + enrollment. Static analysis (CodeQL, gosec, eslint-plugin-security) is gating CI.

Cryptographic primitives are publicly published and reviewed: Argon2id (RFC 9106) for password and host-token hashing, TLS 1.3 for transport, AES-GCM for AEAD, SHA-256 for hashing, ECDSA / Ed25519 via Sigstore for release signatures. All via Go stdlib crypto/* and golang.org/x/crypto/argon2.

All cryptographic operations use Go stdlib crypto/* or golang.org/x/crypto. No re-implementation of crypto primitives.

Go stdlib crypto/* and golang.org/x/crypto are BSD-3-Clause FLOSS.

Argon2id with recommended parameters, TLS 1.3 (mandates modern key exchange), AES-256-GCM, SHA-256. No RSA <2048-bit or ECC <256-bit.

No MD5, SHA-1, DES, RC4, or Dual_EC_DRBG in security mechanisms. SHA-256 is the project's hash primitive for file hashing and integrity (server/cas/, agent uploader). Password storage is Argon2id.

No SHA-1 in default mechanisms. TLS 1.2 cipher suites (legacy opt-in only) restricted to forward-secrecy AEAD; CBC modes disabled. See server/tls/ for the allow-list.

TLS 1.3 mandates perfect forward secrecy. TLS 1.2 fallback (opt-in only for legacy pilots) restricted to forward-secrecy AEAD cipher suites.

User passwords stored as Argon2id hashes with per-user random salt (server/authn/). Host enrollment tokens also stored as Argon2id with a deterministic token-id index for lookup performance.

All keys, nonces, salts, session IDs, and CSRF tokens generated via crypto/rand. No math/rand for security purposes (forbidden by golangci-lint gosec G404).

Distribution channels use HTTPS exclusively. [osps_br_03_02]

Every release artifact (pkg, mobileconfig, SBOM, SHA256SUMS) is signed via cosign keyless OIDC. SHA256SUMS itself ships with SHA256SUMS.sig + SHA256SUMS.pem. The macOS .pkg is additionally Apple Developer-ID-signed and notarized via notarytool. Release pipeline: .github/workflows/release.yml. Cryptographic hashes are not retrieved over HTTP without signature verification.

govulncheck runs in CI on every push, PR, and weekly schedule (.github/workflows/go-vulncheck.yml). OSV-Scanner covers the broader dependency universe including npm (.github/workflows/osv-scanner.yml). CodeQL provides SAST-based vulnerability detection (.github/workflows/codeql.yml). No medium-or-higher severity unpatched vulnerabilities have been publicly known for more than 60 days.

Same as above

GitHub secret scanning + push protection enabled at the repo level. Release pipeline scans release artifacts via .github/workflows/release-secrets-check.yml. SonarCloud flags credential leaks. No working credentials are present in the public repo; secrets at runtime are sourced from /run/secrets via Docker Compose secrets or env vars.

CodeQL workflow (.github/workflows/codeql.yml) runs default + security-extended queries against Go, TypeScript, and Swift on every push, PR, and weekly schedule. golangci-lint v2 includes gosec (a security-focused linter) and staticcheck. uber-go/nilaway runs in a dedicated gating CI job. C bridge in agent/xpcbridge/ is checked by clang-tidy.

CodeQL ships with security rule packs for each language; gosec targets Go-specific security smells (G-rules); eslint-plugin-security and eslint-plugin-no-unsanitized cover JS/TS DOM and injection sinks; zizmor scans GitHub Actions for workflow security issues.

Findings from CodeQL and SonarCloud are triaged and fixed; recent examples include PRs #279 and #280, which addressed SonarCloud global findings. The SonarCloud quality gate is non-overridable on main.

Static analysis runs on every push, every PR, and additionally on a weekly schedule for CodeQL and Scorecard. Effectively per-commit on the main branch.

Go race detector enabled on every test run (go test -race -count=1 in CI). Integration tests run against a real MySQL 8.4 instance (no mocks) to catch SQL- and concurrency-level issues. Playwright E2E suite drives the running React bundle against a real server.

Test runs enable Go race detector and runtime checks; integration tests run with assertions on (testify's require.*). The dev server runs in a debug build with all checks enabled.

No outstanding dynamic-analysis findings (no flaky race-detector failures, no integration-test panics).