Security & Supply Chain

symtrace is designed to be completely safe to execute on any repository, including untrusted or hostile codebases.

Security Architecture Highlights

• Zero Unsafe Rust - Enforced across the entire binary via #![deny(unsafe_code)] in Cargo.toml.
• Contract & Safety Guard Alerting - Detects critical security regressions:
  • REMOVED_NULL_CHECK: Null/nil guard checks deleted before pointer or object dereference.
  • REMOVED_BOUNDS_CHECK: Array index or slicing boundary validations removed.
  • STRIPPED_LOCK_GUARD: Mutex lock acquisitions deleted, exposing shared state to race conditions.
  • OMITTED_RESOURCE_CLEANUP: File descriptor, database connection, or handle close statements dropped.
• Fully Offline - Zero network access, zero telemetry, zero analytics, zero external HTTP/TCP requests.
• Process Isolation - Interactive pager invocations execute directly via explicit process argument vectors (no sh -c or cmd.exe /c shell string evaluation).
• Path Traversal Protection - Repository paths are strictly canonicalized and verified as valid directories prior to Git access.
• Cache Security & Atomic Commits - Unix cache directories are created with 0o700 (owner-only) permissions, and disk writes use atomic rename strategies to prevent partial corruption.

Resource Limits & Fuzzing Protection

To prevent Denial of Service (DoS) attacks via deep nesting or oversized files, symtrace enforces strict execution boundaries:

Resource Guard	Default Value	CLI Flag	Configuration Key
Max File Size	5 MiB (5242880 B)	--max-file-size	limits.max_file_size
Max AST Nodes	200,000 nodes	--max-ast-nodes	limits.max_ast_nodes
Max Recursion Depth	2,048 levels	--max-recursion-depth	limits.max_recursion_depth
Parse Timeout	2,000 ms (2s)	--parse-timeout-ms	limits.parse_timeout_ms

Files exceeding any boundary are automatically skipped with an informative diagnostic notice.

The parser and AST diff engine undergo continuous property-based testing (proptest) and fuzz testing via cargo-fuzz.

Supply Chain Provenance & Signing

Release binaries published to GitHub Releases include cryptographic supply chain attestations:

• Cosign Keyless OIDC Signing - Release assets are keylessly signed using Sigstore/Cosign via GitHub Actions OIDC identity tokens.
• SPDX Software Bill of Materials (SBOM) - Every release bundle includes symtrace.spdx.json detailing exact pinned dependencies and licenses.
• GitHub Artifact Attestations - Build provenance attestations are generated directly by GitHub’s build environment.

Dependency Policy

All third-party Rust dependencies in Cargo.toml are strictly pinned (=x.y.z). Continuous integration runs cargo-deny to verify license compliance and scan for vulnerability advisories.

See SECURITY.md for full security audit documentation.