Argentum

• ci.yml: contents: read (minimal)
• codeql.yml: contents: read + security-events: write (only at job level)
• scorecard.yml: contents: read + security-events: write (only at job level)
• trivy.yml: contents: read
• semgrep.yml: contents: read
• release.yml: contents: read + id-token: write (only for Sigstore OIDC)
• npm-version-check.yml: contents: read

Top-level permissions are minimal; elevated only when necessary.

• security-changelog.yml: version input validated via semantic version check in generate-security-changelog.js
• release.yml: version derived from git tag (git ref), not user-controlled
• All user inputs are typed (string) and used via GitHub Actions environment (automatic escaping)
• No direct shell injection possible: inputs used via ${{ }} template syntax with proper quoting
• Version validation in script ensures only valid SemVer patterns used

• Release assets named with SemVer pattern: argentum-v0.0.7-linux-x64, argentum-cli-v0.0.7-win-x64.exe, etc.
• Sigstore cosign bundles created alongside each binary (e.g., argentum-v0.0.7-linux-x64.cosign-bundle) - bundles contain cryptographic signature tied to GitHub OIDC issuer + repository + SHA256 hash
• SHA256SUMS.txt maps each asset filename to its cryptographic hash
• Release ID (tag name) associated with all assets via GitHub Releases UI
• Tauri desktop installers include version in filename: Argentum_0.0.7_x64-setup.exe, etc.

SECURITY.md "Security Features" section documents:

• AES-256-GCM encryption for credentials at rest
• Credential manager with short-lived key rotation
• No secrets hard-coded in source code
• argenta.yaml (config with encrypted secrets) gitignored
• GitHub Secrets used for CI/CD pipelines
• Access controlled via GitHub repository permissions

Secrets stored encrypted in config/argenta.yaml, never in version control.

docs/releases/v0.0.7.md includes dedicated "Verify Release Integrity" section with:

• Technology used: SHA256 checksums + Sigstore cosign (cryptographic verification)
• Commands to run: sha256sum --check + cosign verify-blob
• Expected output: "<filename>: OK" for SHA256; signature verification result for cosign
• Documentation is separate from build/release pipeline (in docs/releases/, not in .github/workflows/)
• Both integrity (SHA256) and authenticity (Sigstore) verification methods explained

cosign verify-blob command includes:
--certificate-identity-regexp "https://github.com/AG064/argentum"
--certificate-oidc-issuer https://token.actions.githubusercontent.com

This verifies:

• The binary was signed by GitHub Actions workflow in AG064/argentum repository
• The OIDC issuer is token.actions.githubusercontent.com (GitHub's Sigstore issuer)
• The certificate identity matches our repository URL

Documentation is in docs/releases/ (separate from .github/workflows/).

SUPPORT.md (or SECURITY.md "Support" section) documents:

• Supported versions (latest stable release)
• Support duration (security fixes only for latest major version)
• Types of support provided (bug fixes, security updates)
• How to get support (GitHub Issues, Security Advisories)

Example: Only latest v0.0.x receives security updates, older versions unsupported.

SUPPORT.md "Unsupported Versions" section clearly states:

• Versions older than the latest no longer receive security updates
• They "likely contain unpatched security vulnerabilities"
• Users are "strongly encouraged to upgrade"

CONTRIBUTING.md "Pull Request Checklist" section:

• PR requires review before merge
• Branch protection enabled on development (require PR + 1 approval)
• "Changes that break the build" won't get merged

MEMBERS.md Access Inventory shows sensitive resource access only to AG064.

Code review is enforced via GitHub branch protection settings.

Release workflow includes SBOM generation using anchore/sbom-action. Outputs CycloneDX JSON format for each portable binary. SBOM files uploaded as release assets alongside binaries. Auto-generated at build time from build artifacts.

SUBPROJECTS.md documents the policy that would apply if subprojects exist:

• "Currently, Argentum is a single monorepo with no subprojects"
• If subprojects are added in future, each must:
  • Enforce security requirements at least as strict as main codebase
  • Have CI pipeline with SAST (CodeQL or equivalent)
  • Have dependency scanning (Trivy, osv-scanner)
  • Have Security policy (SECURITY.md, SUPPORT.md)
  • Have SBOM generation for release artifacts
  • Have signed releases (Sigstore cosign)

This future-proofs the project for when subprojects may be created.

CONTRIBUTING.md includes "Testing" section (added at line 96):

• How to run tests locally: npm test, npm run test:unit, npm run test:integration, etc.
• What the tests cover: table listing test suites and their purposes
• How to interpret results: explaining pass/fail output
• CI/CD pipeline: explains when tests run automatically

CONTRIBUTING.md "Test Policy for Major Changes" section exists:

• Defines what constitutes a major change (new features, API changes, bug fixes, security changes)
• Specifies what tests to add: unit tests for new functionality, regression tests for bug fixes
• States PR policy: new features require tests, regression tests required for bug fixes
• Acknowledges current thin coverage but commits to testing for major changes

Single-maintainer project: Argentum is maintained by one person (me, AG064) with no additional collaborators.

Branch protection is enabled (direct pushes to development/main blocked).
PR workflow exists and is used for all changes.
Self-review is performed via PR process.

However, requiring non-author human approval is impossible without a second collaborator.
This is a project structure constraint, not a security policy failure.
If the project grows to include additional maintainers, this requirement will be enforced.

SECURITY.md "Security Risks & Threat Model" section includes:

• Threat model covering 11 categories (60+ entries) of critical code paths, functions, and interactions
• Each threat has Likelihood/Impact/Mitigation assessment
• "Threat Model Maintenance" section added: MUST be updated for new features/breaking changes
• "Threat Model Review Required" note at top of section
• docs/releases/TEMPLATE.md includes checkbox: "Verify SECURITY.md threat model reflects new features/attack paths"
• Current threat model covers v0.0.7 release
• Next review scheduled before v0.0.8 release

SECURITY_DEPENDENCY_NOTES.md serves as VEX (Vulnerability Exploitability eXchange) document:

• Documents known vulnerabilities in software components (npm bundled modules)
• Provides non-exploitability details: "The project's direct dependency is correctly overridden"
• Specifies mitigations in place: package.json overrides ensure patched versions are used
• Status for each vulnerability: "No additional action required - project override ensures correct version"

Each entry shows:

• CVE identifier
• Location (bundled npm modules, not direct project dependency)
• Project override in place (package.json overrides.picomatch, etc.)
• Why not exploitable via project code
• Mitigation: npm package.json overrides resolve to patched versions

VEX document updated when new vulnerabilities are discovered or mitigations change.

SECURITY_DEPENDENCY_NOTES.md now includes "SCA Remediation Policy" section with:

• Severity threshold table (Critical: 24h, High: 7 days, Medium: 30 days, Low: best effort)
• License policy (allowed/prohibited licenses)
• Process: Identify -> Prioritize -> Remediate -> Document -> Verify
• Exceptions for bundled npm modules, RUSTSEC, false positives

Trivy runs in CI on every push (from .github/workflows/trivy.yml).
Process documented for handling SCA findings.

release.yml now includes Trivy SCA scan step:

• Runs after build, before release artifacts are uploaded
• Scans release artifacts for Critical/High vulnerabilities
• Uploads results to GitHub Security tab (SARIF format)
• Blocks release if Critical/High vulnerabilities found (exit-code: 1)
• Policy documented in SECURITY_DEPENDENCY_NOTES.md "SCA Remediation Policy" section

Release workflow now:

1. Build binaries
2. Run Trivy scan (CRITICAL/HIGH)
3. If vulnerabilities found -> fail and block release
4. Only proceed if scan passes

.github/workflows/dependency-scan.yml created:

• Runs on: push to development/main AND pull requests
• Runs npm audit --audit-level=high
• Runs Trivy scan on entire codebase (fs mode)
• Uploads results to GitHub Security tab (SARIF)
• Blocks merge if Critical/High vulnerabilities found (exit 1)
• Exceptions can be declared via .trivyignore or osv-scanner.toml

Policy documented in SECURITY_DEPENDENCY_NOTES.md SCA Remediation Policy section:

• Critical: 24h remediation
• High: 7 days
• Exceptions: documented in .trivyignore or per-CVE suppression

Branch protection ensures this check must pass before merge.

SECURITY.md "SAST Remediation Policy" section includes:

• Severity threshold table (Critical: 24h, High: 7 days, Medium: 30 days, Low: best effort)
• Process: Identify (CodeQL) -> Prioritize -> Remediate -> Suppress -> Verify
• Suppression guidelines requiring inline comments explaining why
• Example suppression comment provided

CodeQL runs on every push from .github/workflows/codeql.yml

Branch ruleset for development includes:

• CodeQL Analysis as required status check
• Code scanning rule: CodeQL, Scorecard, Trivy all set to high_or_higher
• Pull request rule: 1 approval required
• Branch protection enforced via GitHub's ruleset API (new format)