# Security policy — `mgf-vm-firecracker`

## Supported versions
The latest `0.1.x` release receives security fixes. Older versions are not maintained.

## Reporting a vulnerability
Email the maintainer (`bassam@magogi.org`) with details; do **not** open a public issue for an
undisclosed vulnerability. Expect an acknowledgement within ~7 days.

## Scope — this is a vendor ADAPTER, not a pure-domain library

`mgf-vm-firecracker` implements mgf-vm-core's `HypervisorBackend` + `StorageBackend` against
**Firecracker / jailer**. Unlike the pure-domain `mgf-vm-core`, this adapter DOES touch the host:

- **Spawns the `jailer` subprocess** — invocations use **argv lists with `shell=False`** (never a
  shell string), per SC-02; arguments are not built by string concatenation of untrusted input.
- **Talks to the Firecracker REST API over its unix domain socket** via `httpx` — the socket path
  is adapter-controlled, not consumer-supplied network input.
- **Handles VM image / rootfs / kernel paths** — paths derived from a `VmSpec` are normalised
  (`resolve()`) and containment-checked before use (SC-15); image files are written with restrictive
  permissions (SC-04) where the adapter owns them.

Vendor/engine I/O is confined to this adapter (the import-linter contract keeps `httpx`/Firecracker
out of the pure core). The privileged daemon surface lives in `vm-vmanager-agent` (its own SECURITY.md).

> **Status (0.1.2):** the adapter implementation is a skeleton; the hardening above describes the
> design the implementation MUST follow as `adapter.py` / `jailer.py` / `api/` land.
