Security Policy
Relevant source files
The following files were used as context for generating this wiki page:
Introduction
The Security Policy for the Unified Security Scanner project defines the framework for identifying, reporting, and mitigating vulnerabilities within the scanner itself and the codebases it analyzes. The project employs an AI-powered, multi-phase scanning strategy designed to detect 9 critical CWE classes while maintaining a false positive rate of less than 5%.
The policy encompasses the core scanner engine, CLI interface, security rules, and documentation. It establishes clear protocols for vulnerability disclosure, supported versioning, and recommended security best practices for users.
Sources: SECURITY.md:39-44, README.md:1-15
Vulnerability Reporting and Response
The project maintains a strict private disclosure policy for security vulnerabilities. Discovered issues should be reported via email to security@unified-scanner.dev rather than through public issue trackers.
Reporting Requirements
Reports must include:
- Type of issue (e.g., SQL injection, Buffer overflow).
- Affected source code location (file paths, URLs, or commit hashes).
- Reproduction steps and any required configurations.
- Proof-of-concept (PoC) code and impact assessment.
Sources: SECURITY.md:12-23
Response Timeline
The maintenance team adheres to a structured timeline for vulnerability remediation:
| Milestone | Target Timeline |
|---|---|
| Initial Response | Within 48 hours |
| Status Update | Within 7 days |
| Critical Fix | Within 30 days |
| Non-Critical Fix | Within 90 days |
Sources: SECURITY.md:25-29
Multi-Phase Security Analysis
The scanner architecture utilizes a three-phase approach to ensure comprehensive coverage and high accuracy.
The diagram shows the sequential scanning phases used to reduce false positives.
- Phase 1: Traditional SAST: Uses tools like Semgrep and CodeQL with high-noise queries to identify potential issues.
- Phase 2: AI-Enhanced Analysis: Executes three iterations to address AI non-determinism and validate Phase 1 findings.
- Phase 3: Targeted Deep Dive: Performs multi-file analysis and intent analysis to confirm critical vulnerabilities.
Sources: README.md:23-32, README.md:113-117
Detection Scope and Severity
The policy classifies vulnerabilities into severity levels that determine CI/CD blocking behavior.
Critical Detection Capabilities
The scanner is configured to detect several high-impact vulnerability classes:
- Injection: OS Command Injection (CWE-78), SQL Injection (CWE-89), and XSS (CWE-79).
- Insecure Deserialization: CWE-502 (Pickle, YAML, JSON.parse).
- Secrets: Hardcoded API keys, tokens, and credentials (CWE-798).
- Malicious Code: Data exfiltration and backdoors (CWE-506).
Sources: README.md:162-175, rules/react/hooks.yml:1-18
Severity Definitions
| Severity | Description | Action Required |
|---|---|---|
| 🔴 CRITICAL | Exposed secrets, credentials, or remote code execution risks. | Fix immediately; blocks commits. |
| 🟠 HIGH | SQL injection, XSS, or end-of-life unmaintained packages. | Fix before merging to production. |
| 🟡 MEDIUM | Outdated packages or missing security headers. | Address in current development sprint. |
| ⚪ LOW | Minor code quality issues or optimizations. | Fix when convenient. |
Sources: QUICK_START.md:103-125
Security Best Practices
Users of the Unified Security Scanner are expected to follow these guidelines to maintain a secure environment:
- Keep Updated: Always utilize the latest version (currently 1.x.x is supported).
- Secure Output: Protect scan reports (SARIF/JSON) as they may contain sensitive findings.
- Network Integrity: Use HTTPS for downloading remote security rules.
- Access Control: Limit execution rights to authorized personnel.
Sources: SECURITY.md:4-8, SECURITY.md:32-37
Configuration and Policy Enforcement
The security posture is managed through .securityrc.json, which allows teams to define "fail-on" conditions.
The sequence illustrates how configuration flags determine the success or failure of a security gate.
Default Fail-On Strategy
The default configuration is set to fail builds on CRITICAL and HIGH findings.
"severity": {
"threshold": "LOW",
"failOn": ["CRITICAL", "HIGH"]
}
Sources: configs/default.json:44-47, QUICK_START.md:214-225
Conclusion
The Security Policy for the Unified Security Scanner ensures a robust defense-in-depth approach by combining traditional static analysis with AI-driven validation. By adhering to the defined reporting protocols and severity-based remediation timelines, the project maintains high standards of integrity for both its own source code and the diverse applications it secures.