# Security Policy

`mgf-standard` ships a **zero-dependency data package** (the engineering-
standards corpus as wheel data + a typed resolver) plus Markdown documentation.
There is no runtime server, no network listener, and no code that handles
untrusted input. The attack surface is minimal by design.

We still take security reports seriously: documentation that prescribes a
security-relevant pattern (the rules in `docs/standards/SECURITY_STANDARD.md`
and the SC-* rules across the corpus) is itself a meaningful target — a rule
that gives bad advice harms every federation project that follows it.

## Supported versions

In the 0.x window, **only the latest PATCH on the latest MINOR receives
fixes.** Per SemVer 0.x and rule AP-03, each MINOR release MAY break the
public API; we do not branch-and-backport across minors.

| Version | Supported |
|---------|-----------|
| `0.1.x` | Yes — latest; fixes ship as `0.1.Y` |
| `< 0.1` | No — pre-release; upgrade to `0.1.x` |

Once v1.0 ships, supported-version policy will move to "the two most recent
MINOR releases."

## Reporting a vulnerability

**Please do not open a public issue or pull request** until we have had a
chance to triage and patch.

To report a vulnerability privately, choose one of:

- **Email:** `bassam@magogi.org` with subject prefix
  `[mgf-standard security]`.
- **Codeberg private security advisory:** open a private vulnerability report
  via [the repository's Security tab](https://codeberg.org/magogi-admin/mgf-standard/security)
  (Settings → Security → Report a vulnerability).

### What to include

- A description of the vulnerability and its impact.
- Steps to reproduce — a minimal reproducer or shell transcript is ideal.
- The version(s) of `mgf-standard` (or `mgf-common`, which depends on it)
  affected.
- The Python version and OS involved.
- Any suggested mitigations or patches you have in mind.

### What to expect

| Stage | Timeline |
|---|---|
| Acknowledgement | within 3 business days |
| Initial assessment + severity rating | within 7 business days |
| Patch + release | within 30 days for high-severity, 90 days for medium |
| Credit + public disclosure | coordinated with the reporter |

We follow a **90-day default embargo**, extendable by mutual agreement if a
patch is not yet ready. After the embargo expires (or a patch ships, whichever
is first), the vulnerability is disclosed in the `CHANGELOG.md` entry for the
fixing release, with credit to the reporter unless declined.

For vulnerabilities with severity ≥ medium, we file a security advisory and
request a CVE. Because `mgf-standard` is distributed from the federation's
self-hosted **devpi index** (the `magogi/prod` stage — see
[`MGF_INFRA.md`](MGF_INFRA.md)) — not pypi.org — there is **no PyPI
auto-yank**: an advisory does not remove an affected version on its own. We
**ship the fixed version first**, then remove the affected version as an
**admin operation on the devpi host** (`devpi remove
mgf-standard==<version>`, over SSH per `MGF_INFRA.md` — the stage is
non-volatile, so removal is a host-side op, not a token or REST op). A
published version is immutable — enforced by the non-volatile stage, not
just policy; removal is reserved for vulnerability removal and
botched-upload recovery, and is recorded in the `CHANGELOG.md`. See
[`docs/standards/PACKAGE_DISTRIBUTION.md`](docs/standards/PACKAGE_DISTRIBUTION.md)
§8 (rule **PKG-07**) for the index's immutability + removal contract.

## Scope

**In scope:**

- Code in `src/mgf/standard/` (the published package).
- Standards documentation in `docs/standards/` that prescribes a
  security-relevant pattern — a rule that gives bad advice is a real
  vulnerability for the projects that follow it.
- Build / release infrastructure (`.woodpecker.yml`, `scripts/`).

**Out of scope:**

- Vulnerabilities in dev-only dependencies (`pytest`, `ruff`, `mypy`,
  `import-linter`) — please report to the upstream project.
- Vulnerabilities in `mgf-common` or other federation siblings that do not
  stem from code or rules in this repo — please report there.
- Issues requiring physical access to a user's machine or an attacker who
  already has root on the host.

## A note on the standards

The [`docs/standards/`](docs/standards/) folder is the **cross-project
engineering security standard** (SC-* rules). This file you are reading is the
**vulnerability-reporting policy** for `mgf-standard` itself. Both
documents are part of the SC-12 contract — every MGF-family project ships both.
