pixel

Only the latest release is supported (SECURITY.md); the upgrade path is brew upgrade, install.sh or pixel self-update, the changelog flags breaking changes, and renamed commands are documented: https://github.com/Pixel-CLI/pixel/blob/main/docs/renamed-commands.md

GitHub issues: https://github.com/Pixel-CLI/pixel/issues

The only vulnerability resolved in the last 12 months, https://github.com/Pixel-CLI/pixel/security/advisories/GHSA-c9f5-vxc4-wjph, was found by a maintainer; an outside reporter would be credited in the advisory's credits.

SECURITY.md (private advisory, first response within 48 hours) and GOVERNANCE.md's Security role (triage, fix, publish the advisory and the release): https://github.com/Pixel-CLI/pixel/blob/main/SECURITY.md#reporting-a-vulnerability

Rust code follows rustfmt and the Clippy lint table in Cargo.toml, as CONTRIBUTING.md requires: https://github.com/Pixel-CLI/pixel/blob/main/CONTRIBUTING.md#gates-run-before-every-pr

CI runs cargo fmt --check and Clippy with -D warnings on every pull request; a failure blocks the merge.

Cargo honours RUSTFLAGS, and the cc crate passes CC, CFLAGS and their target variants to the C code it compiles (tree-sitter grammars, vendored OpenSSL).

The release profile sets strip = "none", and Cargo honours CARGO_PROFILE_RELEASE_DEBUG to keep full debug information.

Cargo resolves the whole workspace as one dependency graph; there is no recursive make.

Release builds pin SOURCE_DATE_EPOCH to the commit time and remap checkout and CARGO_HOME paths (scripts/release-build-env.sh); the Reproducible build workflow builds the release binary twice from different paths and compares sha256 (identical in run 37221200185); SECURITY.md explains how to reproduce a release: https://github.com/Pixel-CLI/pixel/blob/main/SECURITY.md

Install and uninstall with Homebrew (brew install / brew uninstall) or install.sh (a single binary in ~/.local/bin); pixel uninstall removes the hooks and managed blocks pixel install wrote.

install.sh installs to PIXEL_INSTALL_DIR (default ~/.local/bin) and stages under DESTDIR when it is set (from the release after 0.7.0); Homebrew installs under its prefix: https://github.com/Pixel-CLI/pixel/blob/main/scripts/install.sh

CONTRIBUTING.md lists the prerequisites (Rust toolchain, system packages) and the build commands, including feature flags.

URL: https://github.com/Pixel-CLI/pixel/blob/main/CONTRIBUTING.md#build [osps_do_07_01]

Cargo.toml manifests and the committed Cargo.lock: https://github.com/Pixel-CLI/pixel/blob/main/Cargo.lock

Every pull request is evaluated by cargo-deny against deny.toml (RustSec advisories for vulnerable, malicious-flagged and unmaintained crates, a licence allow-list, crates.io as the only source). The main branch ruleset makes it a required status check, so a violation blocks the merge; accepted exceptions are declared with their reason in deny.toml and osv-scanner.toml. Maintainers can bypass only explicitly, through GitHub's bypass option, which the pull request records. The shipped software is Rust only; the JavaScript manifests are documentation tooling and are not distributed.

URL: https://github.com/Pixel-CLI/pixel/blob/main/CONTRIBUTING.md#gates-run-before-every-pr [osps_vm_05_03]

Cargo.toml manifests declare the direct dependencies and Cargo.lock pins the full dependency tree; Dependabot tracks both. [osps_qa_02_01]

rustc's deprecated lint runs with -D warnings in CI, so no deprecated API can merge.

Every pull request runs the full test suite (cargo nextest), Clippy, MSRV, cargo-deny and mutation testing in GitHub Actions, and the main branch only accepts changes through pull requests. [osps_qa_06_01]

69 of the 75 fix pull requests merged in the last six months add or change tests (92%); the mutation gate fails a pull request whose changed code no test exercises.

cargo-llvm-cov (FLOSS) runs the workspace test suite in the Coverage workflow and fails under 80% line coverage; measured 91.97% of lines and 91.01% of regions (run 37219909593): https://github.com/Pixel-CLI/pixel/blob/main/.github/workflows/coverage.yml

CONTRIBUTING.md's Definition of done requires every behaviour change to add or update a test that fails without it, enforced by mutation testing on each pull request. [osps_qa_06_03]

CONTRIBUTING.md's Definition of done requires every behaviour change to add or update a test that fails without it, enforced by mutation testing on each pull request. [osps_qa_06_03]

Clippy runs with warnings denied, plus selected pedantic lints named in the workspace lint table (Cargo.toml).

Least privilege (0700/0600 socket and state, read-only CI tokens), fail-safe defaults (refuse a linked or tracked .pixel/, O_NOFOLLOW writes, paths kept inside the repository), minimal surface (no telemetry, opt-in network): https://github.com/Pixel-CLI/pixel/blob/main/SECURITY.md#security-model

No default mechanism of Pixel relies on SHA-1 or CBC: its hashes are SHA-256 and rustls offers only AEAD suites.

TLS suites are negotiated by rustls and OpenSSL among several algorithms, so a broken one can be dropped by a library update.

API keys can come from environment variables (OPENROUTER_API_KEY, OLLAMA_API_KEY, DEEPSEEK_API_KEY, OPENCODE_API_KEY, PERPLEXITY_API_KEY) or from the 0600 global config, never from the repository's configuration.

Every remote endpoint Pixel reaches by default is HTTPS (model downloads, classify presets, web search, the release check); plain HTTP is used only for a model server on loopback or a URL the user passes explicitly, and a key is never sent over HTTP off loopback.

rustls supports TLS 1.2 and 1.3 only; OpenSSL 3 supports TLS 1.2 and 1.3.

ureq (rustls with webpki roots) and native-tls verify certificates by default; no code disables verification.

Certificates are verified during the TLS handshake, before any HTTP header (including API keys) is sent.

The verification command pins the signer identity: --signer-workflow Pixel-CLI/pixel/.github/workflows/release-build.yml, the release tag (--source-ref) and GitHub-hosted runners, so only the project's release workflow on that tag verifies. [osps_do_03_02]

Arguments are parsed into typed values by clap, hook payloads into typed serde structures, git refs pass ref_guard, and paths read from the index are accepted only inside the repository; the parsers are fuzzed.

Rust memory safety, documented unsafe blocks, O_NOFOLLOW file access, 0600/0700 permissions, confined paths, capped inputs and fuzzing: https://github.com/Pixel-CLI/pixel/blob/main/docs/assurance-case.md

docs/assurance-case.md states the security claims, builds on the threat model and trust boundaries of docs/threat-model.md, argues which secure design principles are applied and how the common (CWE Top 25) weaknesses are countered, and names the residual gaps: https://github.com/Pixel-CLI/pixel/blob/main/docs/assurance-case.md

CodeQL's security queries look for common vulnerabilities (injection, path traversal, unsafe workflows).

Pixel is Rust, but links tree-sitter grammars written in C and has a few documented unsafe blocks; the cargo-fuzz targets feed arbitrary source through that parsing path under AddressSanitizer weekly.