Skip to content

Commit b89aed3

Browse files
fabiendostiefabiendostie
committed
security: implement comprehensive repository security
- Add SECURITY.md policy with vulnerability reporting process - Update .gitignore to protect sensitive memory system data - Add automated security scanning workflow (Bandit, Safety, CodeQL) - Document security best practices and user guidelines Authored-By: Fabien Dostie
1 parent 978af2f commit b89aed3

File tree

3 files changed

+294
-0
lines changed

3 files changed

+294
-0
lines changed

‎.github/workflows/security.yml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
name: Security Scan
2+
3+
on:
4+
push:
5+
branches: [ main ]
6+
pull_request:
7+
branches: [ main ]
8+
schedule:
9+
- cron: '0 6 * * 1' # Weekly on Monday at 6 AM UTC
10+
11+
jobs:
12+
security:
13+
name: Security Analysis
14+
runs-on: ubuntu-latest
15+
permissions:
16+
actions: read
17+
contents: read
18+
security-events: write
19+
20+
steps:
21+
- name: Checkout code
22+
uses: actions/checkout@v4
23+
24+
- name: Set up Python
25+
uses: actions/setup-python@v4
26+
with:
27+
python-version: '3.9'
28+
29+
- name: Install dependencies
30+
run: |
31+
python -m pip install --upgrade pip
32+
pip install bandit safety
33+
34+
- name: Run Bandit Security Linter
35+
run: |
36+
bandit -r .prsist/ *.py -f json -o bandit-report.json || true
37+
38+
- name: Run Safety Check
39+
run: |
40+
safety check --json --output safety-report.json || true
41+
42+
- name: Upload security reports
43+
uses: actions/upload-artifact@v3
44+
with:
45+
name: security-reports
46+
path: |
47+
bandit-report.json
48+
safety-report.json
49+
50+
codeql:
51+
name: CodeQL Analysis
52+
runs-on: ubuntu-latest
53+
permissions:
54+
actions: read
55+
contents: read
56+
security-events: write
57+
58+
strategy:
59+
fail-fast: false
60+
matrix:
61+
language: [ 'python', 'javascript' ]
62+
63+
steps:
64+
- name: Checkout repository
65+
uses: actions/checkout@v4
66+
67+
- name: Initialize CodeQL
68+
uses: github/codeql-action/init@v2
69+
with:
70+
languages: ${{ matrix.language }}
71+
72+
- name: Autobuild
73+
uses: github/codeql-action/autobuild@v2
74+
75+
- name: Perform CodeQL Analysis
76+
uses: github/codeql-action/analyze@v2

‎.gitignore‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
# Prsist Memory System - Secure .gitignore
2+
3+
# CRITICAL: Memory system sensitive data - NEVER COMMIT
4+
.prsist/sessions/active/
5+
.prsist/sessions/archived/
6+
.prsist/sessions/checkpoints/
7+
.prsist/storage/sessions.db
8+
.prsist/storage/memory.log
9+
.prsist/storage/debug-hook-calls.log
10+
.prsist/logs/
11+
.prsist/context/claude-context.md
12+
.prsist/context/project-memory.md
13+
.prsist/tests/test_results.json
14+
.prsist/session_export_*.json
15+
session_export_*.json
16+
*.corrupted*
17+
18+
# Dependencies
19+
node_modules/
20+
pnpm-lock.yaml
21+
bun.lock
22+
deno.lock
23+
pnpm-workspace.yaml
24+
package-lock.json
25+
26+
# Logs and temporary files
27+
logs/
28+
*.log
29+
*.tmp
30+
*.temp
31+
*~
32+
npm-debug.log*
33+
34+
# Build output
35+
build/*.txt
36+
web-bundles/
37+
dist/
38+
39+
# Environment and secrets
40+
.env
41+
.env.local
42+
.env.*.local
43+
*.key
44+
*.pem
45+
*.p12
46+
config/secrets.yaml
47+
config/keys/
48+
49+
# System files
50+
.DS_Store
51+
.DS_Store?
52+
._*
53+
.Spotlight-V100
54+
.Trashes
55+
ehthumbs.db
56+
Thumbs.db
57+
58+
# IDE and editor configs
59+
.vscode/
60+
.cursor/
61+
.windsurf/
62+
.trae/
63+
.idea/
64+
*.swp
65+
*.swo
66+
67+
# Python
68+
__pycache__/
69+
*.py[cod]
70+
*$py.class
71+
*.so
72+
.Python
73+
env/
74+
venv/
75+
ENV/
76+
.venv
77+
pip-log.txt
78+
*.egg-info/
79+
*.egg
80+
*.whl
81+
82+
# Test and coverage
83+
.pytest_cache/
84+
htmlcov/
85+
.coverage
86+
.coverage.*
87+
coverage.xml
88+
*.cover
89+
.mypy_cache/
90+
91+
# Backup files
92+
*.bak
93+
*.backup
94+
*.old
95+
96+
# Development artifacts
97+
test-file-tracking.txt
98+
et
99+
nul
100+
101+
# Legacy/cleanup (remove these from BMAD)
102+
.bmad-core
103+
.bmad-creator-tools
104+
test-project-install/*
105+
sample-project/*
106+
flattened-codebase.xml
107+
bmad-core/
108+
expansion-packs/
109+
tools/
110+
common/
111+
docs/
112+

‎SECURITY.md‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
# Security Policy
2+
3+
## Supported Versions
4+
5+
| Version | Supported |
6+
| ------- | ------------------ |
7+
| 1.0.x | :white_check_mark: |
8+
9+
## Reporting a Vulnerability
10+
11+
We take security vulnerabilities seriously. If you discover a security vulnerability within Prsist, please send an email to the project maintainer rather than using the issue tracker.
12+
13+
**Please include the following information in your report:**
14+
15+
- Type of issue (e.g., buffer overflow, SQL injection, cross-site scripting, etc.)
16+
- Full paths of source file(s) related to the manifestation of the issue
17+
- The location of the affected source code (tag/branch/commit or direct URL)
18+
- Any special configuration required to reproduce the issue
19+
- Step-by-step instructions to reproduce the issue
20+
- Proof-of-concept or exploit code (if possible)
21+
- Impact of the issue, including how an attacker might exploit the issue
22+
23+
## Security Features
24+
25+
Prsist includes several built-in security features:
26+
27+
### Input Validation
28+
- All file paths are validated to prevent directory traversal attacks
29+
- User input is sanitized before database operations
30+
- SQL injection prevention through parameterized queries
31+
32+
### File System Security
33+
- Restricted file access to project directory only
34+
- Path canonicalization to prevent access outside permitted areas
35+
- Safe file operations with proper error handling
36+
37+
### Database Security
38+
- SQLite database with atomic transactions
39+
- No sensitive data stored in memory files
40+
- Proper database connection handling and cleanup
41+
42+
### Memory Management
43+
- Limited memory usage (< 50MB)
44+
- Automatic cleanup of temporary data
45+
- No credential storage in memory files
46+
47+
## Security Best Practices for Users
48+
49+
### Repository Security
50+
1. **Enable branch protection** on main branch
51+
2. **Require pull request reviews** for all changes
52+
3. **Enable secret scanning** and push protection
53+
4. **Use Dependabot** for dependency updates
54+
5. **Limit repository collaborators** to trusted users only
55+
56+
### Local Development
57+
1. **Keep Python and dependencies updated**
58+
2. **Use virtual environments** for development
59+
3. **Review code before committing** sensitive changes
60+
4. **Enable git hooks** for automatic validation
61+
5. **Regularly audit system logs** for suspicious activity
62+
63+
### Production Deployment
64+
1. **Use minimal required permissions**
65+
2. **Enable monitoring and logging**
66+
3. **Regularly backup memory databases**
67+
4. **Keep system and dependencies updated**
68+
5. **Monitor for security advisories**
69+
70+
## Known Security Considerations
71+
72+
### Data Storage
73+
- Session data contains conversation history and project context
74+
- Memory files are stored locally and not encrypted at rest
75+
- Database files should be excluded from version control
76+
77+
### Network Security
78+
- No network communication by default
79+
- Git integration uses local git configuration
80+
- Claude Code integration is local-only
81+
82+
### Access Control
83+
- File system access limited to project directory
84+
- No authentication mechanism (relies on system security)
85+
- Memory data accessible to anyone with file system access
86+
87+
## Security Updates
88+
89+
Security updates will be released as patch versions and announced through:
90+
- GitHub releases
91+
- Security advisories (if applicable)
92+
- Repository README updates
93+
94+
## Disclaimer
95+
96+
This software is provided "as is" without warranty of any kind. Users are responsible for:
97+
- Securing their development environment
98+
- Protecting sensitive project data
99+
- Following security best practices
100+
- Regular security audits of their usage
101+
102+
---
103+
104+
For questions about this security policy, please contact the project maintainer.
105+
106+
Last updated: 2025-01-24

0 commit comments

Comments
 (0)