tisilia

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

Changes are merged into main through pull requests in the public repository before they are released, so interim versions are visible for review.

Repository on GitHub, which uses git. git is distributed.

Every NuGet and npm package carries one shared version, declared by VersionPrefix and VersionSuffix in Directory.Build.props and in the package.json files. ReleaseVersionTests holds them together, and the release workflow refuses a tag that differs from any package's version.

Semantic Versioning 2.0.0 version numbers. The release workflow checks each tag against the regular expression from semver.org, and CHANGELOG.md states that Tisilia follows SemVer from 1.0.0. https://github.com/kkdev92/tisilia/blob/main/CHANGELOG.md

A release is cut by pushing a vMAJOR.MINOR.PATCH[-prerelease] tag. The release workflow publishes only from such a tag, and only when it is on the default branch; a ruleset makes v* tags immutable.

Non-trivial release notes file in repository: https://github.com/kkdev92/tisilia/blob/main/CHANGELOG.md.

No publicly known vulnerability in Tisilia has been fixed, so there is none for release notes to identify. SECURITY.md describes how a report is handled.

Non-trivial SECURITY[.md] file found file in repository: https://github.com/kkdev92/tisilia/blob/main/SECURITY.md. [osps_do_02_01]

GitHub Issues, with templates for bug reports and feature requests.

No bug report has gone unanswered; none has been filed so far, and the maintainer watches the tracker.

No enhancement request has gone unanswered; none has been filed so far.

The GitHub issue archive is public and searchable. https://github.com/kkdev92/tisilia/issues?q=is%3Aissue

SECURITY.md explains how to report a vulnerability, what is in scope, and what not to include in a report. https://github.com/kkdev92/tisilia/blob/main/SECURITY.md

GitHub private vulnerability reporting is enabled, and SECURITY.md links to its form. https://github.com/kkdev92/tisilia/security/advisories/new

No vulnerability report has been received yet.

npm ci and npm run build, then dotnet build src/backend/Tisilia.slnx, as CONTRIBUTING.md documents; CI runs the same steps on Linux and Windows.

The .NET SDK, pinned by global.json, and npm workspaces. No custom build tool.

Everything the build uses is FLOSS: the .NET SDK, Node.js and npm, TypeScript and Vite. The helper scripts run on PowerShell 7, which is MIT-licensed.

An xUnit suite (tests/Tisilia.Contract.Tests); Vitest suites for the runtime, the Nuxt module and the Explorer; a matrix that runs generated clients against a live Kestrel application in Chromium, Firefox and WebKit (scripts/verify-adoption.ps1); and a clean install of the packed packages into a fresh application (scripts/install-check.ps1). CONTRIBUTING.md shows how to run them, and CI runs all of them. https://github.com/kkdev92/tisilia/blob/main/CONTRIBUTING.md

dotnet test src/backend/Tisilia.slnx and npm test, the standard commands of each ecosystem.

GitHub Actions runs the build and every suite on Ubuntu and Windows for each pull request into main and each push to it, and both jobs are required checks for merging. https://github.com/kkdev92/tisilia/blob/main/.github/workflows/ci.yml

CONTRIBUTING.md requires a test for every change in behaviour, and a regression test seen to fail without the fix for every bug fix. https://github.com/kkdev92/tisilia/blob/main/CONTRIBUTING.md

The most recent major change, 0.4.0-alpha in CHANGELOG.md, arrived as one pull request per change, each with its tests: warnings about module digests that change without a code change (#49, #54), conformance gaps in the doctor report (#52), check without evidence (#55) and compiled output left next to a changed file (#56). Each pull request shows its new tests failing with the change taken out. https://github.com/kkdev92/tisilia/blob/main/CHANGELOG.md

The policy is written in CONTRIBUTING.md and repeated in the pull request template's checklist.

C#: TreatWarningsAsErrors, nullable reference types and the .NET analyzers at the latest analysis level (Directory.Build.props). TypeScript: strict, plus exactOptionalPropertyTypes and noUncheckedIndexedAccess; vue-tsc checks the Explorer. CI also verifies dotnet format.

Warnings are errors, so a build with one fails. The only warning switched off is CS1591, missing XML documentation.

Warnings are errors at the latest .NET analysis level, and the TypeScript settings go beyond strict (exactOptionalPropertyTypes, noUncheckedIndexedAccess, noPropertyAccessFromIndexSignature).

The maintainer applies the Saltzer and Schroeder principles. Fail-safe defaults: outside Development the Explorer is not mapped without both AllowProduction and an authorization policy, and what a contract cannot describe exactly is refused. Least privilege: export, conformance and explorer build run code only with an --allow-execute-* flag, and generation never does. Complete mediation: every codec module file is checked against the contract's digest each time it is used or served. Economy of mechanism: no third-party runtime dependencies in the .NET packages or the runtime. Allowlists: an explicit list of JSON media types, and only allowlisted headers are forwarded during SSR. Limited attack surface: redirects are never followed.

Each with its countermeasure. Cross-site scripting in the Explorer: it renders text only (a test forbids v-html, innerHTML and eval) under a content security policy that allows only its own scripts. Code injection: generation executes nothing, and codec modules are never fetched and must match the contract's digest. Header injection: header values with CR, LF or non-ASCII characters are refused. Path traversal: generated files cannot be written outside the output root, symbolic links included, and download names keep only a basename. Denial of service from untrusted responses: byte, depth, token, number-length and time limits, and linear-time header parsing. Credential leakage: credentials come from a provider on each call, the Nuxt module keeps them out of hydration payloads, and a test keeps the Explorer from writing them to browser storage. Open redirects: redirects are refused.

SHA-256 for digests and HMAC-SHA-256 for request identities; no other algorithm.

All of it is implementable with FLOSS: SHA-256 and HMAC come from the MIT-licensed .NET runtime, from Web Crypto in Node.js, or from the runtime's own SHA-256.

HMAC keys must be at least 256 bits: a shorter configured key is refused, and the default key is 256 random bits. Digests are SHA-256.

Only SHA-256 and HMAC-SHA-256; no MD4, MD5, single DES, RC4 or Dual_EC_DRBG.

No SHA-1 and no CBC mode; only SHA-256 and HMAC-SHA-256.

Tisilia defines no key agreement protocol; transport security is the application's TLS.

Tisilia stores no passwords. The Explorer keeps credentials a user types in page memory only.

Keys and nonces come only from cryptographically secure generators: crypto.getRandomValues for the Nuxt module's HMAC key and the scope nonces, and RandomNumberGenerator for conformance session ids.

Distribution channels use HTTPS exclusively. [osps_br_03_02]

No hash is fetched over HTTP. The release workflow attests the build provenance of the packages (actions/attest-build-provenance), which gh attestation verify checks.

No vulnerability in Tisilia's own code is publicly known. One advisory remains in Nuxt's own dependencies (Nuxt is a peer dependency, not shipped by Tisilia): node-forge, which has no upstream fix. The four simple-git and @simple-git/argv-parser advisories are gone since Nuxt DevTools 3.4.3, which no longer depends on simple-git, and GitHub withdrew the braces advisory on 2026-10-23. SECURITY.md describes node-forge and the DevTools fix. https://github.com/kkdev92/tisilia/blob/main/SECURITY.md

No critical vulnerability in Tisilia has been reported.

No valid credential is in the repository or its history. Every commit was scanned before the repository was made public, and the only match was a deliberately invalid JWT-shaped test value. Secret scanning with push protection is enabled.

CodeQL's default setup with the extended query suite analyzes C#, JavaScript/TypeScript and the workflows on pull requests into main, on every push to it and weekly. The .NET analyzers run in every build, with warnings as errors.

CodeQL's security queries cover the common vulnerability classes for C# and JavaScript/TypeScript.

CodeQL's first analysis found three regular expressions with quadratic worst cases on input the server controls; they were fixed before any release, with tests that fail on the previous code. Its other findings were reviewed and dismissed with stated reasons. https://github.com/kkdev92/tisilia/pull/3

CodeQL runs on pull requests into main, on every push to it and weekly; the .NET analyzers run in every build.

Seeded generated-input tests vary the inputs: random mutations of a contract against both schema-validation paths, random number lexemes against the platform's parser, and generated media types. The adoption matrix runs generated clients against a live Kestrel application in Chromium, Firefox and WebKit, and the clean install calls a fresh application through the packed packages. All of them run in CI and in the release workflow before packages are published.

The software is C# without unsafe code, and TypeScript; both are memory-safe.

No vulnerability has been found by dynamic analysis so far.