This repository contains reference implementations of the OPC UA Industrial Joining Technologies (IJT) companion specification. The code is intended for demonstration and interoperability testing — it is not designed or hardened for production deployment without additional security review.

Security fixes are applied to the main branch only. Older tags or releases are not actively maintained.

Please do not open a public GitHub issue for security vulnerabilities.

Report privately by emailing:

Include in your report:

• A description of the vulnerability and its potential impact
• Steps to reproduce or a proof-of-concept
• The affected file(s) / component(s)

We aim to acknowledge reports within 5 business days and provide a fix or mitigation within 30 days for confirmed vulnerabilities.

• The OPC UA server simulator (OPC_UA_Servers/) is a demo server with no authentication or encryption configured by default. Do not expose it on untrusted networks.
• The web client (IJT_Web_Client) binds its WebSocket backend to localhost by default. Review client_config.py and Docker port mappings before any network-accessible deployment.
• Dependencies are kept up to date via Renovate and audited in CI via pip-audit (Python dependencies), npm audit (Node.js dependencies), the C# NuGet vulnerability scan, bandit (Python SAST), and CodeQL static analysis (C#, Python, JavaScript) using the security-extended query suite (.github/workflows/codeql.yml).
• GitHub Actions workflow files are audited by zizmor in the CI workflow when .github/workflows/ changes, or on manual dispatch. Findings are uploaded as SARIF to GitHub Code Scanning (Security → Code scanning alerts). High/Critical findings fail the local root-runner gate; repository branch protection or Code Scanning check-failure settings are required if new Code Scanning alerts should also block merges. The GitHub Actions zizmor job is skipped on fork PRs where security-events: write is unavailable.
• The CI pre-commit job runs the repository hook set on all files. The local and CI zizmor hooks use the same High/Critical severity policy as the root runner so local checks do not become stricter than CI.