PermLang

Users upgrade with npm or the Action's @v0 tag. Patch releases never make code that passed fail, and a release that needs a change says how at the top of its changelog section, as 0.4.0, 0.4.2 and 0.4.3 do (https://github.com/PermLang/PermLang/blob/main/CHANGELOG.md), with upgrade steps in the reference (https://github.com/PermLang/PermLang/blob/main/docs/reference.md#upgrading-from-03-or-earlier) and the support policy in https://github.com/PermLang/PermLang/blob/main/SECURITY.md#supported-versions

GitHub issues, with a form for each kind of report: https://github.com/PermLang/PermLang/issues

All five vulnerabilities fixed in the last 12 months were found by the project itself, as the threat model says (https://github.com/PermLang/PermLang/blob/main/docs/threat-model.md#vulnerabilities-found-and-fixed); SECURITY.md promises credit to anyone who reports one: https://github.com/PermLang/PermLang/blob/main/SECURITY.md#how-a-report-is-handled

SECURITY.md is the coordinated disclosure policy: a report is acknowledged within 7 days, confirmed within 14, fixed within 30 days (critical or high) or 90, and the fix and the advisory are released together: https://github.com/PermLang/PermLang/blob/main/SECURITY.md#how-a-report-is-handled [osps_vm_01_01]

docs/policies.md sets the coding standard (TypeScript strict mode with noUncheckedIndexedAccess, ESLint's and typescript-eslint's recommended rules including type-aware ones, license headers), and CONTRIBUTING.md requires changes to follow it: https://github.com/PermLang/PermLang/blob/main/docs/policies.md#code and https://github.com/PermLang/PermLang/blob/main/eslint.config.js

Required checks enforce it on every pull request: the lint job (ESLint), the type check (tsc, strict), and a test for license headers and hidden characters: https://github.com/PermLang/PermLang/blob/main/.github/workflows/ci.yml and https://github.com/PermLang/PermLang/blob/main/test/source-files.test.ts

PermLang builds no native binaries: the build compiles TypeScript to JavaScript with tsc.

The build (tsc) doesn't minify or strip anything: the published JavaScript keeps the source's names and structure, with type declarations beside it, and npm installs it as published.

The build is a single tsc run over src (npm run build); nothing builds subdirectories recursively: https://github.com/PermLang/PermLang/blob/main/package.json

Building the same source gives the same package, byte for byte: CI builds twice on every pull request and compares, and SECURITY.md says how to rebuild a release and compare it with npm's: https://github.com/PermLang/PermLang/blob/main/SECURITY.md#rebuilding-a-release

npm install --save-dev permlang (or npx permlang) installs it, and npm uninstall permlang removes it; the GitHub Action is used with uses: PermLang/permlang@v0: https://github.com/PermLang/PermLang/blob/main/docs/getting-started.md

PermLang installs through npm, which follows its standard conventions for where packages go (the project's node_modules, or npm's --prefix and global settings).

CONTRIBUTING.md gives the Node version, how to install the dependencies, build, test and lint: https://github.com/PermLang/PermLang/blob/main/CONTRIBUTING.md#setting-up [osps_do_07_01]

package.json lists the direct dependencies, package-lock.json every package with its version and checksum, and each release's SBOM (CycloneDX) lists everything installing PermLang installs: https://github.com/PermLang/PermLang/blob/main/package.json and https://github.com/PermLang/PermLang/blob/main/SECURITY.md#whats-in-a-release-sbom

The required dependency-review check fails any pull request that adds or updates a dependency with a known vulnerability of any severity, or a license not on the allow-list, unless the advisory is let through with a written reason: https://github.com/PermLang/PermLang/blob/main/.github/workflows/dependency-review.yml and https://github.com/PermLang/PermLang/blob/main/docs/policies.md#vulnerabilities-in-dependencies [osps_vm_05_03]

Every dependency is an ordinary npm package, listed in package.json and updated with npm, and Dependabot proposes updates weekly: https://github.com/PermLang/PermLang/blob/main/docs/policies.md#getting-and-tracking-them

PermLang uses current Node and TypeScript APIs, and Dependabot keeps its dependencies and Actions current. Deprecation warnings are fixed when they appear (the SBOM script stopped passing a shell to execFileSync for Node's DEP0190). It's tested on Node 20 to 26; dropping Node 20, past its end of life, is planned for 0.5: https://github.com/PermLang/PermLang/blob/main/ROADMAP.md

CI runs the whole test suite on Node 20, 22, 24 and 26 on Linux, and Node 24 on Windows, for every pull request, and those checks are required: https://github.com/PermLang/PermLang/blob/main/.github/workflows/ci.yml and https://github.com/PermLang/PermLang/blob/main/docs/policies.md#tests [osps_qa_06_01]

Every bug fix comes with a test that fails without it (https://github.com/PermLang/PermLang/blob/main/CONTRIBUTING.md#making-a-change), and the fixes in the last six months did, including the five security fixes: https://github.com/PermLang/PermLang/blob/main/CHANGELOG.md

98.9% of statements are covered (7,186 of 7,266, Vitest's V8 coverage of src on 2026-10-07; Codecov, which counts a partly covered line as missed, reports less), measured on every pull request: https://github.com/PermLang/PermLang/blob/main/docs/policies.md#tests

Every change comes with a test that proves it, and fails without the change: https://github.com/PermLang/PermLang/blob/main/docs/policies.md#tests and https://github.com/PermLang/PermLang/blob/main/CONTRIBUTING.md#making-a-change [osps_qa_06_03]

CONTRIBUTING.md says to write the test first, and where each kind goes (fixtures, the adversarial suite, property tests): https://github.com/PermLang/PermLang/blob/main/CONTRIBUTING.md#making-a-change

TypeScript runs in strict mode with noUncheckedIndexedAccess, and ESLint with typescript-eslint's type-aware rules; an error from either fails CI, and a rule is switched off for a line only with the reason beside it: https://github.com/PermLang/PermLang/blob/main/docs/policies.md#code

The threat model shows how each of Saltzer and Schroeder's principles is applied, with evidence: https://github.com/PermLang/PermLang/blob/main/docs/threat-model.md#secure-design-principles

PermLang implements no cryptography. It uses SHA-256, from Node, only to fingerprint files it records, so a change to them shows in the lock.

PermLang has no cryptographic features to switch: it uses SHA-256 only to fingerprint files it records.

PermLang stores no credentials. The Action's only one is a GitHub token, passed as its github-token input (by default the job's own token), kept apart from any configuration, and replaceable in the workflow without rebuilding anything: https://github.com/PermLang/PermLang/blob/main/docs/design.md#github-action

The command line has no network code. The Action talks to GitHub through git, the GitHub CLI, and GitHub's own Actions, all over HTTPS: https://github.com/PermLang/PermLang/blob/main/docs/design.md#files-written-processes-and-network

PermLang's own code makes no TLS connections. The tools the Action calls (git and the GitHub CLI) connect only to GitHub, which accepts TLS 1.2 or later.

PermLang's own code makes no TLS connections. git and the GitHub CLI, which the Action calls, verify GitHub's certificates by default, and PermLang doesn't change that.

PermLang's own code makes no TLS connections, and sends nothing private: the command line has no network code.

Every release since 0.3.2 is signed with Sigstore (keyless, through GitHub's OIDC): a SLSA build-provenance attestation and, since 0.4.2, an SBOM attestation, attached to each release, plus npm provenance. SECURITY.md explains how to verify them with gh attestation verify, cosign, or npm audit signatures: https://github.com/PermLang/PermLang/blob/main/SECURITY.md#verifying-a-release

Every input is checked against what's allowed, and anything else is an error: config keys and values against lists, each command's options, the lock's and adapters' formats, dependency names against npm's rules, and every entry of the dependencies archive. A broken input stops the check (exit code 2) rather than being skipped: https://github.com/PermLang/PermLang/blob/main/docs/threat-model.md#attack-surface-and-threats

TypeScript strict mode with noUncheckedIndexedAccess; objects with no prototype for data from repositories; iterative walks instead of recursion; git and tar run without a shell; Node run by its full path; Actions pinned by commit; text from code escaped wherever it's shown: https://github.com/PermLang/PermLang/blob/main/docs/threat-model.md#common-weaknesses-countered

The threat model is the assurance case: the threat model and attack surface, the trust boundaries, an argument for each secure design principle, and the common weaknesses countered, with the evidence for each: https://github.com/PermLang/PermLang/blob/main/docs/threat-model.md

CodeQL (security queries for JavaScript/TypeScript and GitHub Actions).

TypeScript, memory-safe.