# Security policy

ash_hooks is an auth-boundary library — signature verification, secret handling, and
SSRF guarding are its core. Security reports are welcome and taken seriously.

## Reporting a vulnerability

**Do not open a public issue for a security vulnerability.**

Use GitHub's private vulnerability reporting: the **Security** tab of this repository →
*Report a vulnerability* (enabled 2026-08-22). It reaches the maintainer privately and
coordinates disclosure.

Include what you can: the affected surface (inbound verification, outbound signing,
SSRF guard, HTTP adapter, retention/redaction), a minimal reproduction, and the versions
involved. **Never include real secrets or production signed payloads** — synthesize the
smallest bytes that reproduce.

You will get an acknowledgement within 7 days. Fixes for accepted vulnerabilities ship
as patch releases on the supported minor (ADR-0010) and are credited in the CHANGELOG
unless you prefer otherwise.

## Scope

In scope:

- Signature verification bypasses (any path where an unauthenticated or replayed
  delivery is accepted)
- Secret exposure (DSL/config leakage, storage of secret-derived bytes, telemetry)
- SSRF guard escapes (destination validation, DNS-rebinding, redirect chains, TLS
  verification weaknesses)
- Memory/resource exhaustion through the HTTP adapters
- Redaction/retention escapes (payload bytes surviving where they must not)

Out of scope:

- Consumers' own policies, domains, or deployments (the package injects no read
  policies — ADR-0005's consumer-governed posture; operators own their authz)
- Vulnerabilities in dependencies themselves (report upstream; we track and bump)
- Anything behind an explicitly relaxed floor (a consumer opting into unbounded
  adapters, disabled destination validation in tests, etc.)

## Known posture notes

These are deliberate design postures, not vulnerabilities — each documented with its
rationale:

- The `:httpc` adapter assembles giant NON-2xx bodies inside OTP before the package
  cut (its moduledoc); `AshHooks.Http.Bounded` (the default) bounds every framing.
- Literal-IP https endpoints require the IP in the certificate's iPAddress SAN
  (ADR-0009) — a cert without it fails closed with `:cert_ip_mismatch`.
- Raw provider payloads persist in the ledger by design (verification and audit
  require them); read exposure is governed by consumer policies (ADR-0005 amendment).