Skip to content

Repository navigation

Security: RogueByteOfficial/HARDTRACE

Security

SECURITY.md

Security Policy

Reporting Security Vulnerabilities

If you discover a security vulnerability within RogueByte HARDTRACE, please report it privately:

Please do NOT report security vulnerabilities via public GitHub issues.

Threat Assumptions & Scope

  1. Untrusted Binary Firmware: HARDTRACE is designed to parse untrusted, corrupted, or malicious firmware images without executing them. Memory safety bounds, file size guards (256MB limit), and safe recursive sweep sweeps prevent host execution.
  2. Untrusted Serial Telemetry: Malformed or flood UART streams are parsed with strict bounds, regex limits, and escape filtering.
  3. Evidence Ledger Integrity: HARDTRACE implements a local SHA-256 hash chain to record events and detect accidental tampering. As documented in docs/SECURITY_MODEL.md, local hash chains do not guarantee non-repudiation against an attacker with root filesystem write access; external cryptographic anchors or remote key signing must be used for formal legal chain-of-custody.

There aren't any published security advisories