atmos

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

We provide nightly (prerelease) Release Candidates based on HEAD of main, as well as from time to time have "test" releases from feature branches.

https://github.com/cloudposse/atmos/releases

Repository on GitHub, which uses git. git is distributed.

We practice semver. https://atmos.tools/cli/versioning

Every version is a tagged immutable release.

We use release drafter and every release has a comprehensive description consisting of every associated Pull Request and is organized by chapters whether it's a fix/enhancement/etc.

https://github.com/cloudposse/atmos/releases/tag/v1.227.0

Further more, we publish a mandatory changelog entry for each minor/major change: https://atmos.tools/changelog

We use Dependabot security-update pull requests to remediate known vulnerabilities. Dependabot includes the relevant vulnerability information, including CVE identifiers when assigned, in the pull request title and description. Release Drafter automatically incorporates the merged Dependabot pull request title and description into the published release notes. Therefore, releases identify publicly known run-time vulnerabilities fixed by included Dependabot updates that have CVE assignments.

We use GitHub Issues and provide a Bug Reporting template.

https://github.com/cloudposse/atmos/issues
https://github.com/cloudposse/atmos/tree/main/.github/ISSUE_TEMPLATE

We use GitHub Issues.
https://github.com/cloudposse/atmos/issues

We have a solid track record for resolving bugs.

https://github.com/cloudposse/atmos/issues?q=is:issue+state:closed+label:bug

We always attempt to respond and in many cases implement enhancement requests.

https://github.com/cloudposse/atmos/issues?q=is:issue+state:closed

We do not delete GitHub Issues or Pull Requests. There's a record of everything.

https://github.com/cloudposse/atmos/issues?q=is%3Aissue
https://github.com/cloudposse/atmos/pulls?q=is%3Apr

We have an organization wide SECURITY.md in cloudposse/.github and viewable from the repo.

https://github.com/cloudposse/atmos/tree/main?tab=security-ov-file

Our SECURITY.md directs private vulnerability reports go to security@cloudposse.com

https://github.com/cloudposse/atmos/tree/main?tab=security-ov-file

We have not received any vulnerability reports in the past 6 months.

Yes, we provide a comprehensive build system based on Magefile: "go tool mage ..." Everything in the entire project is automated. Since atmos itself is a task runner, we use atmos itself to help us manage the build process.

Yes, we use Magefiles which are common in the Go language ecosystem.

Atmos is built using Golang with permissive open source tooling.

Yes, we have ~85% test coverage with go test.

Yes, we simply use go test.

Yes, we have ~85% test coverage as of August 2026.

Every single change runs CI tests through GitHub Actions. Every merge goes through a merge queue with required checks.

We require that test coverage does not regress using Codecov, therefore every new feature or code change must have 85%+ or better test coverage.

Yes, we use codecov comments on each PR to provide this evidence.

We use Claude skills for this documentation.

We run extensive linting using "golangci-lint" as well as our own custom-gcl linters.

Yes, we use precommit hooks to enforce linting, and further more revalidate it as part of our CI that precommit hooks are satisfied.

Yes, we have no compile time warnings.

Cloud Posse created Atmos. Cloud Posse is the steward and the primary maintainer of the project.

Andriy Knysh (@aknysh) started the project. He is active in the project, and he performs the releases. Erik Osterman (@osterman) is the founder of Cloud Posse. He led the development for the past year, and he wrote 63 of the last 100 commits. He accepts commits, and he receives private vulnerability reports. Both developers are primary developers.

These design principles are visible in the code and in the configuration.

Least privilege. Each workflow starts with a "contents: read" baseline. Each job then declares more narrow permissions. See https://github.com/cloudposse/atmos/blob/main/.github/workflows/codeql.yml

Least common mechanism. A custom linter, lintroller, rejects os.MkdirTemp and os.Setenv in tests. Tests must use t.TempDir() and t.Setenv(). Each test then has its own temporary directory and its own environment.

Fail-safe defaults and limited attack surface. Atmos runs no daemon. Three optional features bind a local listener. All three features are off by default. The Terraform registry cache binds only to the loopback address.

Economy of mechanism. Atmos builds with cgo disabled. The result is one static binary with no C dependencies.

Separation of privilege. A merge to main requires a code-owner review, a signed commit, and the merge queue. The signed-commit rule and the force-push rule have empty bypass lists. These rules also apply to administrators.

Open design. The code, the CI configuration, and the security policy are public. Protection depends on signatures and on access control. It does not depend on secrecy of the design.

Input validation. Each GitHub Action is pinned to a commit hash. A workflow enforces this rule. See https://github.com/cloudposse/atmos/blob/main/.github/workflows/verify-sha-pinning.yml Six fuzz targets test the YAML parser, the template engine, the merge engine, and the flag parser.

Atmos is a local command-line tool. The operator controls its inputs. These are configuration files on disk, command-line arguments, and flags. Atmos runs no daemon. Three optional features bind a local listener when the operator enables them, and all three are off by default. Atmos sends usage telemetry, which the operator can disable. This threat model governs the list below.

Malformed or invalid configuration (CWE-20). Atmos validates configuration against a published JSON schema. The "atmos validate schema" and "atmos validate stacks" commands do this check. Atmos rejects an invalid configuration before it uses the values.

A tampered or substituted download. Atmos downloads tool binaries. Mitigation: Atmos verifies the checksum and the cosign signature of each tool, and it checks the Rekor transparency log. A lockfile pins each tool version. See pkg/toolchain/verification/.

Path traversal in archive extraction (CWE-22). Atmos extracts archives during vendoring and tool installation. A malicious archive can write files outside the target directory. Mitigation: CodeQL includes the go/zipslip rule. Atmos found such a defect and corrected it.

Secret disclosure in logs and output (CWE-532). Atmos handles cloud credentials and secret values. Mitigation: Atmos masks secret values in its output automatically. TruffleHog scans the full history for verified secrets and blocks the pull request. CodeQL includes the go/clear-text-logging rule.

Command injection through subprocesses (CWE-78). Atmos starts Terraform, OpenTofu, and Helmfile. Mitigation: Atmos runs only the commands that the operator declares in the validated configuration. Semgrep and CodeQL scan for unsafe subprocess patterns.

An unauthenticated local listener (CWE-306). The Terraform registry mirror is an optional feature. When the operator enables it, it accepts no inbound authentication. Mitigation: the feature is off by default. It binds only to the loopback address on an ephemeral port. It runs for one invocation, and it leaves no daemon behind.

A downgraded transport (CWE-319). Atmos contacts cloud providers and identity endpoints. Mitigation: Atmos rejects a token or OIDC endpoint that does not use the https scheme, and it returns an error. The code contains no InsecureSkipVerify.

Unintended disclosure of data through telemetry (CWE-359). Atmos sends usage telemetry to PostHog. The payload contains the command name, the Atmos version, the operating system, the processor architecture, an error flag, a CI flag, the CI provider name, a container flag, and, for Atmos Pro users, the workspace identifier. Mitigation: Atmos does not send configuration files, stack manifests, secrets, or repository content. The operator can disable telemetry, or send it to a private PostHog instance. See https://atmos.tools/cli/telemetry

Data races in concurrent code (CWE-362). Atmos processes stacks and components in parallel. A data race can corrupt output or stop the program. Mitigation: the "atmos test race" configuration runs the race detector. The docs/fixes/ directory records the defects that this configuration found.

Weak cryptographic functions (CWE-327). Mitigation: CodeQL includes the go/weak-sensitive-data-hashing rule. MD5 and SHA-1 appear only where an external protocol requires them, and each use records the reason.

Vulnerable or compromised dependencies (CWE-1395). Mitigation: Dependabot, dependency review, and govulncheck. govulncheck analyses the call graph, and it reports only the vulnerabilities that this binary can reach. Go validates module paths against the public checksum database.

Atmos uses only published cryptographic algorithms. It gets them from age (X25519 and ChaCha20-Poly1305), from SOPS, and from the Go standard library.

Atmos calls existing FLOSS cryptographic libraries. It implements no cryptographic algorithm of its own. The libraries are filippo.io/age, getsops/sops, golang.org/x/crypto, and the Go standard library.

All cryptographic software that Atmos uses is FLOSS. This includes age, SOPS, golang.org/x/crypto, and the Go standard library.

Atmos uses the default key lengths of age and of the Go standard library. Atmos sets no shorter length.

Atmos uses no broken cryptographic algorithm for a security purpose.

Atmos uses no broken or risky algorithm for a security purpose. MD5 and SHA-1 appear only where an external protocol requires them. Each use has a comment that records the reason and a linter suppression. The reasons are the S3 SSE-C protocol, the AWS SSO cache key layout, the Windows certificate thumbprint, and Aqua checksum compatibility.

Atmos uses the TLS client of the Go standard library. It negotiates ECDHE key agreement, which gives forward secrecy. Atmos sets no custom TLS configuration, and the code contains no InsecureSkipVerify.

Atmos stores no user passwords. Atmos is a local command-line tool. It has no user accounts and no authentication of its own.

Atmos uses crypto/rand for each security purpose. These include the DPoP and OAuth web flows, TLS certificate generation, and GitHub Actions secret encryption. math/rand appears only in the retry backoff jitter, which has no security purpose.

Distribution channels use HTTPS exclusively. [osps_br_03_02]

Atmos retrieves each cryptographic hash over HTTPS.

Atmos releases publish a SHA256SUMS manifest on GitHub, over HTTPS.

The Atmos toolchain installer downloads third-party tools. It resolves them through the aqua registry, which it fetches from https://github.com/aquaproj/aqua-registry over HTTPS. For a github_release tool, Atmos builds the checksum URL itself, and that URL is always https. For an http tool, the URL comes from the registry definition; every download URL in the standard registry uses https.

Atmos also verifies a cosign signature for each tool that publishes one, and it checks the Sigstore Rekor transparency log. See pkg/toolchain/verification/.

In the 24 months to 28 August 2026, Atmos identified 19 Critical or High vulnerabilities in the dependencies of the binary. Atmos remediated all of them, and none is open. The median time was 5 days. 18 of the 19 took less than 30 days.

Cloud Posse has published no security advisory for Atmos. No vulnerability has been disclosed in the Atmos source code. Two Critical vulnerabilities occurred in dependencies during the last 24 months. Atmos remediated both, each in 15 days.

TruffleHog scans the full Git history for verified secrets on each pull request, and it blocks the merge. GitHub secret scanning and push protection are enabled on the repository.

Atmos runs four FLOSS static analysis tools in CI, all uploading SARIF to GitHub code scanning: CodeQL (Go and JavaScript/TypeScript), Semgrep (p/ci ruleset), govulncheck, and golangci-lint v2 with a custom lintroller module plugin. All four are defined in .github/workflows/codeql.yml and gate every release, since they run on every push to main and every merge-queue commit. Linter configuration is in .golangci.yml.

CodeQL's Go query suite looks for common vulnerability classes and has produced findings in Atmos across CWE-mapped rules including go/zipslip (CWE-22, path traversal in archive extraction), go/clear-text-logging (CWE-312), go/weak-sensitive-data-hashing (CWE-327/916), and go/allocation-size-overflow (CWE-190). Semgrep's p/ci ruleset adds a second independent rule set. govulncheck goes further than pattern matching: it performs SSA call-graph reachability analysis, reporting only CVEs the compiled binary can actually reach, so its findings carry low false-positive rates. Results from all three land in the repository's public code scanning tab.

Findings from static analysis are triaged and dispositioned in this repository's GitHub Security tab, which is publicly visible. Since January 2025, 47 High-severity and zero Critical-severity findings were raised against first-party code. Twenty-seven were remediated in code and nineteen were dismissed with recorded justification after review determined they were not exploitable in Atmos's threat model — the largest class, go/clear-text-logging, covers output a local CLI writes to the invoking user's own terminal. One finding remains open at the time of writing, raised nine days ago.

Cloud Posse reports the distribution rather than the median alone. Median time to disposition was 2.4 days for remediated findings, but twelve of the forty-seven exceeded thirty days, the longest at 359. That tail is predominantly go/clear-text-logging and go/allocation-size-overflow findings ultimately dismissed as inapplicable, where the elapsed time reflects triage latency rather than an unremediated confirmed vulnerability. The exception, and the most substantive item in this record, is a single go/zipslip finding (CWE-22, archive path traversal) that took 187 days from detection to remediation. Atmos extracts archives during vendoring, so Cloud Posse names this finding explicitly rather than reporting only the aggregate.

No static analysis finding has resulted in a published security advisory for Atmos or in a vulnerability in a released binary. Cloud Posse has identified the structural cause of the triage tail, the repository ruleset governing code-scanning results runs in evaluation mode, so a High-severity finding does not block a merge, and is moving that ruleset to active enforcement as the remaining backlog clears.

CodeQL, Semgrep, and govulncheck run on every push to main, every pull request event (opened, labeled, unlabeled, synchronize), and every merge-queue commit, with an additional weekly scheduled scan. golangci-lint runs on every pull request and merge-queue commit. Analysis therefore occurs on every commit that reaches a protected branch, exceeding the daily cadence this criterion suggests.

Atmos maintains six native Go fuzz targets covering its untrusted-input surfaces: FuzzUnmarshalYAML (pkg/utils/yaml_fuzz_test.go), FuzzProcessTmpl and FuzzIsGolangTemplate (internal/exec/template_utils_fuzz_test.go), FuzzDeepMergeNative (pkg/merge/merge_native_fuzz_test.go), and FuzzParseClosureDepth and FuzzParseKeyValuePair (pkg/flags/). These exercise YAML deserialization, Go template evaluation, the stack-configuration merge engine, and CLI flag parsing with arbitrary input to catch panics. The project additionally provides atmos test race, defined in .atmos.d/test.yaml, which runs the suite under the Go race detector with randomized test ordering.

Atmos is written entirely in Go, a memory-safe language, and is built with CGO_ENABLED=0 at every build site — release builds (.goreleaser.yml), local and CI builds (magefiles/build.go), and test builds. No C or C++ is compiled into any distributed binary, so the project produces no software written in a memory-unsafe language.