# Security Policy

`mgf-fedres` is a federation sibling of [`mgf-common`](https://codeberg.org/magogi-admin/mgf-common).
It is a **headless core library** — the schema set, the version-aware reader, the
manifest + sync engine, the `SourceProvider` seam, and the `fedres` CLI — with a
single runtime dependency (`jsonschema`, which brings `referencing`). It runs no
network service, opens no outbound connections, and handles no credentials, so
its security surface is limited to **how it parses untrusted JSON/NDJSON** and how
it touches the local filesystem.

The defining posture is **fail-closed**: an unreadable file, malformed JSON, an
unknown `schema_version`/`v`, or any schema violation is an error (a nonzero exit
for the CLI; an `UNREADABLE`/`UNKNOWN` state for the reader) — never a guess and
never a crash that leaks a stack trace as data.

## A note on parsing + the filesystem

- **Deserialization is safe by construction:** payloads are read with the stdlib
  `json` module only — no `pickle`, no `yaml.load`, no `eval`. Documents are then
  validated against the shipped JSON Schemas (closed enums, `additionalProperties:
  false`, required fields) before any consumer trusts them.
- **Filesystem reads** target operator/CLI-supplied paths and, through the
  `DiskProvider`, the project's own `fed-resources/` tree. The `live/` directory is
  ephemeral and gitignored; `generated/` is integrity-anchored by a per-file
  `sha256` manifest, so tampering surfaces as `TAMPERED` rather than passing
  silently.

## Supported versions

In the 0.x window, **only the latest MINOR receives fixes** (per
[SemVer 0.x](https://semver.org/#spec-item-4) and rule **AP-03**). Fixes ship as
the next PATCH on the latest MINOR.

| Version | Supported |
|---------|-----------|
| `0.1.x` | ✅ — latest MINOR (pre-alpha) |
| `< 0.1` | ❌ — pre-publish development |

## Reporting a vulnerability

**Please do not open a public issue or pull request** until we have had a chance
to respond. Email the maintainer (see the Codeberg profile for `magogi-admin`)
with a description, reproduction, and impact.
