Last reviewed: 2026-06-24

This is the canonical security policy for the PEAC Protocol. It describes how to report a vulnerability, which versions receive security fixes, what supply-chain attestations the project ships, and where the broader security and stability model is documented.

• Email: security@peacprotocol.org.
• GitHub security advisories may be opened privately at https://github.com/peacprotocol/peac/security/advisories.
• Do not open a public issue for a suspected vulnerability.
• Coordinated disclosure is preferred; details below.

Please include:

• Affected version(s), package(s), and reproducer.
• Expected versus observed behavior.
• Your assessment of impact and severity, if any.

Timelines are targets and may flex for exceptional cases; the reporter is kept in the loop and the disclosure calendar is coordinated.

Security fixes ship in a new release of the latest release line, currently v0.16.x (latest release v0.16.5). Earlier release lines do not receive fixes; upgrade to the latest release.

See Compatibility matrix for runtime and wire-format compatibility, and Security operations for fix policy by surface state within the latest release line.

• Packages published by the release workflow carry npm provenance: an in-toto attestation with the SLSA Provenance v1 predicate, generated through GitHub Actions OIDC trusted publishing. After installing, run npm audit signatures in the consuming project to verify registry signatures and provenance attestations.
• SHA-pinned GitHub Actions; CodeQL and dependency review run on every pull request.
• Production-dependency audit must be clean on every release; the gate and allowlist quality bar are documented below.
• Full supply-chain controls: Security operations.

CI runs scripts/audit-gate.mjs, which enforces the following:

Recommended CI configuration:

• Default CI (pull requests): node scripts/audit-gate.mjs.
• Release CI: AUDIT_STRICT=1 node scripts/audit-gate.mjs.
• Enterprise CI: PEAC_AUDIT_STRICT=1 node scripts/audit-gate.mjs.

Allowlist quality bar (security/audit-allowlist.json): each entry requires advisory_id, package, reason, why_not_exploitable, where_used, expires_at (max 90 days dev, 30 days prod), remediation, issue_url, scope, dependency_chain, verified_by, owner, added_at. Entries missing required fields fail closed. Production-scope entries may never allowlist HIGH or CRITICAL.

The repository runs a fail-closed invisible / bidi Unicode scan (scripts/find-invisible-unicode.mjs) on every CI run and local guard.sh invocation. The scanner rejects dangerous Unicode categories (bidi overrides, zero-width characters, invisible formatters) in tracked source files. GitHub's diff view may show a bidi banner even when the scan is clean; the scan is the authoritative check.

• CodeQL javascript-typescript and security-extended queries run on pull requests, pushes to main, and weekly.
• Dependency review blocks CRITICAL advisories and denies GPL-3.0 / AGPL-3.0 introductions.
• Independent third-party security review has not been completed for this release. Current review coverage includes CodeQL, dependency review, provenance attestations, audit gating, threat-model coverage, and release verification. Any completed third-party review will be listed here with scope and date.

Full trust documentation is organized in Trust artifacts. Pointers:

• Threat model: consolidated threat catalog with per-threat test-coverage links.
• Stability contract: classification of every public surface.
• SLO and Benchmark methodology.
• Security operations: operational detail.
• Key custody and tenancy: key custody, tenancy, procurement.
• Security considerations spec.
• Verifier security model spec.
• HTTP transport security.
• OWASP ASI mapping.

Execution, lifecycle, and provisioning carrier surfaces are shipped and covered by their profile specifications:

• CLI carrier profile
• Lifecycle observation profile
• Provisioning lifecycle profile

The carrier security posture is:

• no raw secret capture by default;
• redaction or hashing defaults for argv, stdin, stdout, and stderr;
• hash-only default for stream captures unless an explicit capture policy enables raw capture;
• environment-variable allowlists plus value hashing, not blanket environment dumps;
• explicit argv_mode for shell-string invocations;
• bounded byte ceilings on command capture, with truncation or hashing instead of silent drops;
• lifecycle records are observational only and do not imply PEAC decisions, trust scores, policy enforcement, or payment finality.

Each rule is covered by the shipped profile specs and threat-model coverage.

• Security: security@peacprotocol.org.
• General: contact@peacprotocol.org.
• GitHub Security Advisories: https://github.com/peacprotocol/peac/security/advisories.