From b43f047056d4d9f652ea3acac4a1c437fffb3bf8 Mon Sep 17 00:00:00 2001 From: sunny-wego Date: Wed, 23 Sep 2026 11:16:51 +0800 Subject: [PATCH 1/2] docs(security): write down the threat model and correct two claims Narrow the edge-cli sentence to the workflow's paths filter, stop naming an admin count and a delivery guarantee for advisory notifications, make the out-of-scope bullet compatible with in-scope token storage, add a threat model for the repository and release pipeline, and code-own SECURITY.md. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_01ThXwuYTEizf7foXH3biz5P --- .github/CODEOWNERS | 6 ++++++ SECURITY.md | 51 +++++++++++++++++++++++++++++++++++++++------- 2 files changed, 50 insertions(+), 7 deletions(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index aebc8dd..bde2cc1 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -111,6 +111,12 @@ src/config-dir.ts @sunny-wego @yeouchien-wego @chuyeowego src/target.ts @sunny-wego @yeouchien-wego @chuyeowego src/config.ts @sunny-wego @yeouchien-wego @chuyeowego +# THE DECLARED SCOPE. The self-update and credential entries above cite +# SECURITY.md as their reason for being owned. If any writer could narrow that +# scope without a signer's review, the stated reason for owning those paths +# could shrink with it. +/SECURITY.md @sunny-wego @yeouchien-wego @chuyeowego + # THE INPUT TO THE api<->cli CONTRACT CHECK. Owned for REVIEW VISIBILITY, not # for runtime reach - and the distinction is the reason this comment exists. # diff --git a/SECURITY.md b/SECURITY.md index 5760ccf..43facb4 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -8,11 +8,13 @@ we prefer.** `security@wego.com` also reaches us, and is the right choice if you would rather not use GitHub for this. We prefer the Security tab because a report there can be taken into a temporary -private fork and fixed there. `main` is public and `edge-cli` publishes on every -merge to it, so a vulnerability fixed in the open is disclosed by its own diff -before the fixed binary reaches a single user. Nothing else in this repository -closes that window. A report there also notifies all ten repository admins, -rather than landing in one mailbox. +private fork and fixed there. `main` is public, and `edge-cli` publishes whenever +a merge changes the CLI's source or build (the `paths:` filter in +`.github/workflows/edge-cli.yml`). A fix for a vulnerability is such a change, so +a fix developed in the open is disclosed by its own diff before the fixed binary +reaches a single user. Nothing else in this repository closes that window. A +report there also reaches the repository's maintainers through GitHub, rather +than landing in one mailbox. Reporting this way is not what lets us publish an advisory. We can do that either way, and always could. It only changes where the fix is developed. @@ -66,10 +68,45 @@ which version you are on. - The Wego API and website. This policy covers the CLI and its release pipeline; reports about the wider Wego platform are triaged by Wego's security team rather than by this repository's maintainers. -- Findings that require an attacker to already control the user's machine or - their account. +- Findings that require an attacker to already run code as the user, or to + already hold their Wego credentials. Exposure to *other* local users or + processes, such as the permissions on stored tokens, is in scope. - Missing hardening with no demonstrated impact. +## Threat model + +This section is about the repository and its release pipeline. The scope above +is about the people who run the CLI. + +**Who we defend against:** anyone outside the `wego` GitHub organization. That +includes the author of a pull request from a fork, anyone who can influence the +bytes an install or `wego update` downloads, and a compromised third party such +as an upstream action, a dependency or a vendor. + +**What we protect, in priority order:** + +1. People running `wego update` and the `/install` script. +2. The credentials the CLI holds. +3. The release pipeline and the signed build records it produces. + +**Where the boundary sits:** + +- The repository is public, so a pull request from a fork runs with a read-only + `GITHUB_TOKEN` and no secrets. No workflow here uses `pull_request_target`, + and none that a fork can trigger starts a privileged `workflow_run`. +- A change to a release path needs a review from a code owner, as listed in + `.github/CODEOWNERS`. +- Only the release automation and the release signers can create a release tag. +- What a release carries once it is built is described under "How releases are + protected" below. + +**Insiders:** members of the organization acting within the access they were +granted are out of scope. A member who is coerced, a member who is negligent, +and a member whose account is taken over through the person, by phishing or +social engineering, stay in scope. A leaked or stolen member credential is also +in scope, but it ranks below issues an outsider can reach. That ranking is +deliberate. + ## How releases are protected Useful background if you are looking at the supply chain: From 5b093db772442630bf6efcf2af3b4ee5a08f6334 Mon Sep 17 00:00:00 2001 From: sunny-wego Date: Wed, 23 Sep 2026 12:14:12 +0800 Subject: [PATCH 2/2] Update SECURITY.md --- SECURITY.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 43facb4..e1791cd 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -100,12 +100,12 @@ as an upstream action, a dependency or a vendor. - What a release carries once it is built is described under "How releases are protected" below. -**Insiders:** members of the organization acting within the access they were -granted are out of scope. A member who is coerced, a member who is negligent, -and a member whose account is taken over through the person, by phishing or -social engineering, stay in scope. A leaked or stolen member credential is also -in scope, but it ranks below issues an outsider can reach. That ranking is -deliberate. +**Insiders:** Members of the organization acting within the access they were +granted are out of scope for this policy. Insider risk is managed through Wego’s +internal access and monitoring controls. A member who is coerced or negligent, or +whose account is taken over through phishing or social engineering, remains in +scope. Leaked or stolen member credentials are also in scope and are triaged +based on their demonstrated impact. ## How releases are protected