Skip to content
symtrace

Security & Supply Chain

symtrace is designed to be completely safe to execute on any repository, including untrusted or hostile codebases.

Security Architecture Highlights

Section titled “Security Architecture Highlights”
  • Zero Unsafe Rust — Enforced across the entire binary via #![deny(unsafe_code)] in Cargo.toml.
  • Fully Offline — Zero network access, zero telemetry, zero analytics, zero external HTTP/TCP requests.
  • Process Isolation — Interactive pager invocations execute directly via explicit process argument vectors (no sh -c or cmd.exe /c shell string evaluation).
  • Path Traversal Protection — Repository paths are strictly canonicalized and verified as valid directories prior to Git access.
  • Cache Security — Unix cache directories are created with 0o700 (owner-only) permissions to prevent unauthorized local reading of cached AST structures.

Resource Limits & Fuzzing Protection

Section titled “Resource Limits & Fuzzing Protection”

To prevent Denial of Service (DoS) attacks via deep nesting or oversized files, symtrace enforces strict execution boundaries:

Resource GuardDefault ValueCLI FlagConfiguration Key
Max File Size5 MiB (5242880 B)--max-file-sizelimits.max_file_size
Max AST Nodes200,000 nodes--max-ast-nodeslimits.max_ast_nodes
Max Recursion Depth2,048 levels--max-recursion-depthlimits.max_recursion_depth
Parse Timeout2,000 ms (2s)--parse-timeout-mslimits.parse_timeout_ms

Files exceeding any boundary are automatically skipped with an informative diagnostic notice.

The parser and AST diff engine undergo continuous property-based testing (proptest) and fuzz testing via cargo-fuzz.

Supply Chain Provenance & Signing

Section titled “Supply Chain Provenance & Signing”

Release binaries published to GitHub Releases and package repositories include cryptographic supply chain attestations:

  • Cosign Keyless OIDC Signing — Release assets are keylessly signed using Sigstore/Cosign via GitHub Actions OIDC identity tokens.
  • SPDX Software Bill of Materials (SBOM) — Every release bundle includes symtrace.spdx.json detailing exact pinned dependencies and licenses.
  • GitHub Artifact Attestations — Build provenance attestations are generated directly by GitHub’s build environment.

Dependency Policy

Section titled “Dependency Policy”

All third-party Rust dependencies in Cargo.toml are strictly pinned (=x.y.z). Continuous integration runs cargo-deny to verify license compliance and scan for vulnerability advisories.

See SECURITY.md for full security audit documentation.