check-security

check-security

Role: review the shard for security defects.

Failure model: untrusted input reaches an unsafe operation, a boundary that should enforce a capability does not, or a path crosses a trust line without a check.

Trust boundaries are project-specific, but the shape repeats. Read the descriptor and design docs for the project's trust boundaries, and the recurring defect-class catalog in references/known-pitfalls.md, before sweeping. The general trust lines:

• Caller-supplied data at a native edge is untrusted. A seq, stream, iterator, or buffer from the calling language, materialized into a fixed-size native array, must be bounded before it is realized (the load-bearing rule in skills/shared/references/architecture.md). The native length guard is the second line of defence, not the first.
• Files and paths from outside the trust line are untrusted. A malformed header, a symlink loop, a path with crafted unicode, a parent directory the process does not own.
• Caches and persisted state read back at startup are untrusted at read time. A corrupt or attacker-written cache file must fail clean.
• Credentials, tokens, and entitlements are untrusted. A forged or corrupted entitlement must not grant elevated behavior or crash the process.
• The native edge itself is a memory-safety boundary. A native body that retains a caller-owned pointer, double-frees a handle, or reads past a slice's length is a critical finding; native memory unsafety reachable from untrusted input is the highest-severity bug class.
• Extension or scripting entry points are partially trusted. They must not reach the filesystem, the network, or process spawning except through an explicit capability gate.

Look for

1. Buffer arithmetic. Every allocation and copy whose size flows from a file header, a network read, or caller input. Size-doubling growth without an overflow guard. Any user-controlled count flowing into indexing.
2. Filesystem. stat versus lstat in walks; path joins with user-supplied components; TOCTOU between check and use; symlink handling in a recursive walk; paths with control characters or null bytes.
3. Parser surfaces. Any decoder for an external format (a media container, a serialization format, a wire protocol): a header that claims a size larger than the payload, a count of zero or absurdly large, a field the decoder does not support. Each must error, not crash or read past the buffer.
4. Native handle lifetime. For every handle type at the edge: is the finalizer or destructor registered? Can the handle be used after free? Can two threads free the same handle? Is the handle stored in a global another module could free from under the owner? The ownership discipline itself is check-memory's; the reachability from untrusted input is here.
5. Capability boundary. Extension or scripting entry points must not reach filesystem, network, or process-spawning primitives except through explicit gates. An unrestricted eval against untrusted input is a finding.
6. Entitlement validation. A credential or entitlement parser must reject corrupt signatures cleanly; the entitlement path must not be writable by an attacker via a path trick; an expired or invalid entitlement must downgrade cleanly without leaving elevated behavior on.
7. Crash reachability. For each abort, panic, unreachable, or hard assertion in the shard: can untrusted input steer execution there? An untrusted-input-driven crash is the desktop equivalent of a server-side denial of service.
8. Secrets. A credential, key, or token written to a log, embedded in an error message, or committed to the repository.