Skip to content

Reviewing a Security Control

The harness handles hostile text at scale. A change to any of the boundaries below needs the same scrutiny as a change to TrustSight's own security model.

Boundaries

Boundary Where it lives What a change risks
No execution of generated content validators/syntax.py, tests/test_self_security.py Running attacker-supplied shell.
No fetching of generated URLs generators/llm.py, network gate in self-security tests Egress to attacker-controlled endpoints.
Bounded reads harness/sanitizer.py, generators/llm.py Memory exhaustion or unbounded logs.
Inert rendering harness/safe_text.py Terminal escape injection.
Parameterized storage harness/environment.py, scripts/sbom.py SQL injection or command injection.
Untrusted campaign config is confined within in harness/paths.py, tests/test_mcp.py Reading a recipe, template, baseline or price file from outside the tree.
Inputs are rendered, never evaluated generators/inputs.py A template engine executing expressions from campaign data (H1).
Pinned dependencies uv.lock, CI Supply-chain drift.
The image pins the same instrument .github/trustsight-commit, Dockerfile, docker.yml The image measuring a different TrustSight than CI.
Secrets scripts/scan_secrets.py, .pre-commit-config.yaml Committed credentials.

Review checklist

  • Does the change introduce a new subprocess, network call, or eval-like API? If so, it must be gated.
  • Does it parse attacker-controlled text? Size bounds and escape handling must be present.
  • Does it accept a path from campaign.yml or a tool argument? It must be confined to its allowed root.
  • Does it add a new record field? Check it against FORBIDDEN_RECORD_FIELDS.
  • Does it change the Judge matrix? The change must map to a specification update and new tests.
  • Does it move the measured TrustSight build? Update .github/trustsight-commit and re-baseline the campaigns.
  • Does it relax a constraint? A calibration case or self-security test must cover the relaxation.