Skip to content

SECURITY.md

Latest commit

 

History

History
84 lines (58 loc) · 4.4 KB

SECURITY.md

File metadata and controls

84 lines (58 loc) · 4.4 KB
Raw

Security Policy

Table of contents

Scope

This bundle is development-only (see below). It anonymizes data for local/testing use and must not be enabled in production.

Attack surface

  • Configuration (YAML) defining which fields to anonymize.
  • Runtime data passed through anonymizers (entities, arrays)—must not be logged with secrets in dev.

Threats and mitigations

Threat Mitigation
Misuse in production Documented as dev-only; install with --dev and do not register bundle in prod.
Commands in prod console All nowo:anonymize:* commands run EnvironmentProtectionService (kernel env must be dev/test; prod config/bundles registration blocked).
--env=dev against production DSN Configurable DSN/host denylist (nowo_anonymize.environment_protection.blocked_dsn_substrings) matched against DATABASE_URL / MONGODB_URL (and hosts) and Doctrine connection url / host / dbname params when ManagerRegistry is available.
Stats path traversal (--stats-json / --stats-csv) Paths are resolved under stats_output_dir, canonicalized, and rejected if they escape that directory (including absolute paths outside the base).
Empty hash_preserve salt HashPreserveFaker applies nowo_anonymize.hash_preserve.default_salt (defaults to %kernel.secret%) when the per-call salt option is empty, avoiding unsalted dictionary-friendly hashes.
Destructive TRUNCATE Tables with truncate=true require interactive confirmation or --force; non-interactive runs abort truncate without --force.
Data leakage in logs Avoid verbose logging of raw PII in anonymization pipelines.
Hung export subprocesses (FrankenPHP/FPM) export.timeout (default 180s) on Symfony Process; demo Caddy/PHP deadlines sit above it (REQ-RUNTIME-001).

Dependencies

Run composer audit in consuming projects; keep the bundle updated.

Logging

Do not log full production-like datasets or secrets during anonymization runs.

Reporting a vulnerability

If you discover a security issue in this bundle, please report it responsibly:

  • Do not open a public GitHub issue.
  • Email the maintainers (e.g. via the address in composer.json or the repository's "Security" / "About" section) with a description of the issue and steps to reproduce.
  • We will respond as soon as possible and work with you on a fix and disclosure.

Important note

This bundle is development-only and must not be used in production. It is intended for anonymizing data in development and test environments. Do not install or enable it in production.

Thank you for helping keep this project and its users safe.

Remediations addressed

Previously accepted residuals that are now mitigated:

  1. DSN denylist only on env vars — also inspects Doctrine DBAL connection parameters.
  2. Unsalted hash_preserve — configurable default salt (hash_preserve.default_salt → %kernel.secret%).
  3. Stats export path escape — --stats-json / --stats-csv cannot write outside stats_output_dir.

Release security checklist (12.4.1)

Before tagging a release, confirm:

Item Notes
SECURITY.md This document is current and linked from the README where applicable.
.gitignore and .env .env and local env files are ignored; no committed secrets.
No secrets in repo No API keys, passwords, or tokens in tracked files.
Recipe / Flex Default recipe or installer templates do not ship production secrets.
Input / output Inputs validated; outputs escaped in Twig/templates where user-controlled.
Dependencies composer audit run; issues triaged.
Logging Logs do not print secrets, tokens, or session identifiers unnecessarily.
Cryptography If used: keys from secure config; never hardcoded.
Permissions / exposure Routes and admin features documented; roles configured for production.
Limits / DoS export.timeout + PHP/Caddy hierarchy documented (REQ-RUNTIME-001).

Record confirmation in the release PR or tag notes.