Security Policy
Relevant source files
The following files were used as context for generating this wiki page:
Mutineer maintains a strict security posture by limiting dependencies and enforcing private vulnerability reporting. The project prioritizes the stability of the CLI contract and protects against supply-chain vulnerabilities by avoiding unsafe Ruby methods.
Supported Versions
Only the current release line receives security fixes. Users must run the latest version to remain protected under the security policy.
| Version | Supported |
|---|---|
| 1.6.x | Yes |
| Older than 1.6 | No |
Sources: SECURITY.md:5-10
Reporting a Vulnerability
You must report vulnerabilities privately to prevent public exposure before a fix exists. Mutineer uses GitHub private vulnerability reporting for this purpose.
- Navigate to the New Security Advisory page.
- If the page does not accept reports, enable private vulnerability reporting in the repository security settings.
- Submit the details of the vulnerability.
Do not open public GitHub issues or include security details in pull requests.
Sources: SECURITY.md:12-25
Supply-Chain and Execution Security
Mutineer follows "Zero runtime dependencies" to minimize the attack surface. It relies solely on the Ruby Standard Library and the Prism parser.
Unsafe Method Restrictions
The project explicitly forbids the use of eval to prevent supply-chain scanner flags and code injection risks. The redefine strategy uses load on temporary file snippets instead of execution via eval.
Sources: AGENTS.md:7-11
Code Review and Automated Scanning
Automated rules in the cubic.yaml configuration flag potential security regressions.
| Rule Name | Security Focus |
|---|---|
| Security and secrets | Flags hardcoded secrets and unsafe shell interpolation. |
| Path Traversal | Monitors file handling and CI Action inputs for traversal risks. |
| Ultrareview | Automatically triggers high-risk reviews for lib/** and .github/workflows/**. |
Sources: cubic.yaml:18-24, cubic.yaml:54-58
Release and Deployment Security
Mutineer utilizes automated CI gates and Trusted Publishing to secure the delivery of the gem to users.
The diagram shows the tag-driven release flow and the use of OIDC for secretless publishing.
Trusted Publishing
The release workflow uses Trusted Publishing (OIDC) via GitHub Actions. This removes the need for long-lived API keys or manual OTP entry during the gem push process.
Sources: AGENTS.md:76-85
Major Version Protection
A behavior change to the GitHub Action's defaults triggers a major version bump. This ensures consumers pinning @v<major> do not receive breaking default flips without opting in.
Sources: AGENTS.md:68-70
Conclusion
Mutineer ensures project security through a combination of private reporting channels, zero-dependency architecture, and automated CI protections. By utilizing OIDC for releases and forbidding unsafe execution methods like eval, the project maintains a stable and secure environment for mutation testing.