# Security Policy — mgf-vm-sdk

## Reporting a vulnerability

**Do not** file a public issue or open a PR for a suspected vulnerability. Instead:

- **Email**: `bassam@magogi.org` with the subject prefix `[mgf-vm-sdk security]`.
- Include: a description of the issue, the affected component, a proof-of-concept where possible, and the impact you observed.
- Acknowledgement target: within **5 business days**. Fix or documented mitigation target: within **30 days** for confirmed, exploitable issues. Coordinated disclosure timelines are negotiated case-by-case.

For non-security friction (a design call you'd push back on, a missing primitive, an awkward contract), file in [`FEEDBACK.md`](FEEDBACK.md) — the public, designed-for-friction channel.

## Scope

`mgf-vm-sdk` is a **pure-Python domain library** — state machine, typed contracts, fakes. It does NOT:

- Execute privileged operations.
- Open sockets, files, or external connections.
- Parse untrusted input from the network or the filesystem (the `VmSpec` is validated by the consumer at the boundary; the library trusts it inside).

The hardware-touching surface lives in the adapter libraries (`mgf-vm-libvirt`, `mgf-vm-firecracker`) and the privileged daemons (`vm-vmanager-agent`). Each has its own `SECURITY.md` for their respective scopes.

## Threat model — read these first

Architectural threat-model context lives in the central docs repo:

- `vm-vmanager-docs/ARCHITECTURE.md` (boundaries, privilege model)
- `vm-vmanager-docs/DECISIONS.md` (security-related ADRs: D-D3 identity, D-D4 multi-tenancy, D-G3 error taxonomy, D-G4 log redaction)

## Standards alignment

This library follows the `mgf-common` SC-* rules. The per-rule status is tracked in `docs/inprogress/MGF_STANDARDS_CONFORMANCE.md`.
