wardlatch

Only the latest release is supported; npx wardlatch@latest runs it (a bare npx can reuse an older cached copy), so upgrading is running it again; the changelog states each change in behaviour. https://github.com/deimos-hq/wardlatch/blob/main/SECURITY.md#supported-versions

GitHub issues. https://github.com/thearchitect0x-glitch/wardlatch/issues

Both vulnerabilities fixed so far were found by the project itself, so there was no outside reporter to credit: the virtual-environment interpreter (fixed in 0.1.3) and GHSA-23m2-fmmq-w3pr (fixed in 0.1.6). The credit policy is in SECURITY.md. https://github.com/deimos-hq/wardlatch/blob/main/SECURITY.md#credit

Acknowledge (72 h), assess (7 days), fix privately with a regression test, release, disclose with credit. https://github.com/thearchitect0x-glitch/wardlatch/blob/main/SECURITY.md#how-a-report-is-handled

The JavaScript house rules and ShellCheck-clean bash are written down and required. https://github.com/thearchitect0x-glitch/wardlatch/blob/main/CONTRIBUTING.md#coding-standards

test/conventions.test.mjs checks the rules a machine can (imports, no host shell, no writes, network only in probe.mjs, certificate checks, headers, layout); ShellCheck runs in CI. https://github.com/thearchitect0x-glitch/wardlatch/blob/main/test/conventions.test.mjs

No native binaries.

No build or installation system of its own; npm installs the source as it is.

No build.

Nothing is built; the source is used directly.

npm: npx wardlatch (nothing installed), or npm install -g wardlatch and npm uninstall -g wardlatch.

Installation is npm's, which honours its standard location settings (--prefix, npm_config_prefix); the package has no install scripts.

git clone, then npm test; nothing to install. https://github.com/thearchitect0x-glitch/wardlatch/blob/main/CONTRIBUTING.md#working-on-it

package.json declares no dependencies and the Node engine (>=18.17), and a test enforces it. https://github.com/thearchitect0x-glitch/wardlatch/blob/main/package.json

No npm dependencies; the GitHub Actions are pinned by SHA and monitored by Dependabot; Scorecard checks for known vulnerabilities weekly. https://github.com/thearchitect0x-glitch/wardlatch/blob/main/.github/dependabot.yml

Nothing is vendored. The only copied third-party content is two public root certificates (test data), checked against the advisory's fingerprints by a test.

Node built-ins only, with node: imports; CI runs the tests with --throw-deprecation --pending-deprecation on Node 18, 20 and 22, so a deprecated API fails CI. https://github.com/thearchitect0x-glitch/wardlatch/blob/main/.github/workflows/ci.yml

The suite runs on every push and pull request and reports pass or fail. https://github.com/thearchitect0x-glitch/wardlatch/actions/workflows/ci.yml

Five of the six bugs fixed so far have a regression test: piped output cut off (0.1.1) and awk without sudo (0.1.2) in be5c642; ignored options and the --paths crash in 11b1390; an unreadable plugin version shown as SAFE in dab2043 (these four were each seen to fail with the bug put back); and the file race, covered by tests of the new reader in dab2043. The sixth, npm test on Node 22, is covered by the CI matrix itself. https://github.com/thearchitect0x-glitch/wardlatch/blob/main/test/cli.test.mjs

92.4% of lines, 91.0% of functions with Node's built-in, FLOSS coverage; npm run coverage fails below 80%. https://github.com/thearchitect0x-glitch/wardlatch/actions/runs/39576659804

https://github.com/thearchitect0x-glitch/wardlatch/blob/main/CONTRIBUTING.md#testing-policy

https://github.com/thearchitect0x-glitch/wardlatch/blob/main/CONTRIBUTING.md#testing-policy

Every available check that needs no dependency is on and fails CI. https://github.com/thearchitect0x-glitch/wardlatch/blob/main/CONTRIBUTING.md#coding-standards

Fail-safe defaults (any doubt is UNKNOWN, exit 2), complete mediation through the controls, least privilege (never asks for root), limited attack surface (no server, no dependencies, nothing written). https://github.com/thearchitect0x-glitch/wardlatch/blob/main/ASSURANCE_CASE.md#secure-design-principles

No security mechanism of its own depends on a cryptographic algorithm.

It implements no cryptographic algorithm; each runtime's TLS negotiates its own.

It processes no authentication credentials or private keys of its own (the key scan detects and masks keys in files; it never uses them).

All network traffic is TLS (HTTPS); nothing plain-text.

Its own handshake uses Node's default minimum of TLS 1.2; the probes deliberately use each runtime's defaults, which are what is being measured.

Every probe verifies certificates; the one exception is the reachability handshake, which sends no request, and a test fails if verification is turned off anywhere else. https://github.com/thearchitect0x-glitch/wardlatch/blob/main/ASSURANCE_CASE.md#3-trust-boundaries-and-the-argument

It sends no private information at all; probes send a bare GET after verification.

Since 0.1.3, every release is built by .github/workflows/release.yml from a signed tag, and its npm package and source archive carry Sigstore attestations (keyless, recorded in the public transparency log), attached to the GitHub release as .sigstore.json bundles with SHA256SUMS. docs/RELEASING.md explains how to verify with gh attestation verify (no key to import; 0.1.3 and 0.1.4 verify under the repository's earlier name) and how to check the tag signatures against the SSH signing key GitHub publishes for the maintainer. 0.1.0 to 0.1.2 predate this and are not signed. https://github.com/deimos-hq/wardlatch/blob/main/docs/RELEASING.md#verifying-a-release

Every release, v0.1.0 to v0.1.6, has an annotated tag signed with the maintainer's SSH signing key; GitHub shows each as Verified. 0.1.0 to 0.1.2 were tagged afterwards at the commits npm recorded as their gitHead. docs/RELEASING.md gives the git verify-tag steps. https://github.com/deimos-hq/wardlatch/tags

Options against an allowlist (unknown ones refused), --incident against the shipped ids, versions parsed by digit patterns, the container tool name as one word, only regular files under a size cap read, names escaped on output, incident data validated by tests. https://github.com/thearchitect0x-glitch/wardlatch/blob/main/test/cli.test.mjs

Python probes run isolated (-I), every child process and connection has a timeout, depth and size caps, files opened read-only and non-blocking, terminal escapes neutralised, deprecations fail CI. https://github.com/thearchitect0x-glitch/wardlatch/blob/main/ASSURANCE_CASE.md#common-weaknesses-and-how-each-is-countered

Threat model, trust boundaries (with a diagram), the argument per requirement with evidence, secure design principles, common weaknesses countered, and what is not defended. https://github.com/thearchitect0x-glitch/wardlatch/blob/main/ASSURANCE_CASE.md

CodeQL security-and-quality on every change. https://github.com/thearchitect0x-glitch/wardlatch/blob/main/.github/workflows/codeql.yml

JavaScript and bash only; no memory-unsafe code.