Cybersecurity analysis report + fork hardening

[duksh]

Summary

Two commits from a cybersecurity reinforcement analysis of this fork:

1. SECURITY_ANALYSIS.md — full findings report from a three-part audit (CI/supply-chain posture, code-level cryptographic surface, testing/fuzzing assurance), with prioritized findings (P1–P4) and a 12-item remediation roadmap. Highlights:

• The release pipeline (wheel-builder.yml → pypi-publish.yml) had no repository-owner guard, so a tag push on the fork would attempt a full wheel build and OIDC PyPI publish.
• No fork-valid vulnerability reporting channel (upstream policy points to pyca's advisory page).
• Upstream-relevant gaps: unhashed ci-constraints-requirements.txt in the publish job, no cargo-deny/CodeQL/Scorecard, no zeroize, no in-repo fuzzing, missing unsafe_op_in_unsafe_fn lint, un-deprecated CAST5/IDEA/SEED/Blowfish re-exports.

2. Fork hardening (Bucket 1, fork-only fixes)

• SECURITY.md: directs library vulns upstream, fork-specific issues to this repo's advisory page
• .github/CODEOWNERS
• pypi-publish.yml: publish job owner-guarded — a fork can never attempt a publish or mint attestations
• wheel-builder.yml: sdist entry job owner-guarded (skipping it skips the whole chain); PR runs kept so workflow changes stay testable
• ci.yml: linux-downstream (third-party code execution) skipped on forks, with allowed-skips on the alls-green gate
• benchmark.yml: owner-guarded

Upstream-relevant items (owner guards, lint tightening, hash-pinning) are candidates for separate small PRs to pyca/cryptography, per the roadmap in the report.

Testing

• All four modified workflow files pass YAML validation.
• Workflow-only + documentation changes; no library code touched, so the Python/Rust test suites are unaffected.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DWoMomNAcBM3e8duJrb2do

---

Generated by Claude Code

Summary by CodeRabbit

• Documentation

  • Added security policies and a fork-specific security analysis with reporting guidance and prioritized recommendations.
  • Updated documentation link checking to ignore known unreliable or slow external sites.

• Chores

  • Added default repository ownership.
  • Improved CI and release workflow safeguards for forked repositories.
  • Reduced unsupported or unnecessary architecture-specific build jobs.

[coderabbitai]

📝 Walkthrough

Walkthrough

The changes add fork ownership and security documentation, restrict selected workflows to the upstream repository, adjust PPC64LE build matrices, allow a skipped downstream job, and ignore two problematic documentation links during link checking.

Changes

Fork controls

Layer / File(s)	Summary
Fork governance documentation .github/CODEOWNERS, SECURITY.md, SECURITY_ANALYSIS.md	Adds default repository ownership, fork-specific vulnerability reporting guidance, and a prioritized security analysis with remediation roadmap.
Fork-aware workflow execution .github/workflows/*.yml, docs/conf.py	Adds repository-owner conditions for selected jobs, permits the downstream job to be skipped, disables selected PPC64LE matrix entries, and ignores two link-check URLs.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: alex

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately captures the two main changes: a cybersecurity analysis report and fork hardening across workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/repo-cybersecurity-analysis-lkx1on

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@SECURITY_ANALYSIS.md`:
- Around line 15-18: Update SECURITY_ANALYSIS.md to reflect the implemented
remediation: mark the findings about fork-unguarded publishing, missing
SECURITY.md/CODEOWNERS, and benchmark/downstream jobs running on forks as
remediated, or clearly label the document as a pre-remediation snapshot. Ensure
the report no longer presents these controls as absent in the final security
posture.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 3126b766-7434-4d6f-ac88-b354dec9b008

📥 Commits

Reviewing files that changed from the base of the PR and between e027b8c and 77e6503.

📒 Files selected for processing (9)

• .github/CODEOWNERS
• .github/workflows/benchmark.yml
• .github/workflows/ci.yml
• .github/workflows/linkcheck.yml
• .github/workflows/pypi-publish.yml
• .github/workflows/wheel-builder.yml
• SECURITY.md
• SECURITY_ANALYSIS.md
• docs/conf.py

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Update the report to reflect this PR’s remediation.

These sections still state that publishing is unguarded, no SECURITY.md/CODEOWNERS exists, and benchmark/downstream jobs run on forks. The final workflows and documentation now implement those controls, so either mark these findings as remediated or label the report as a pre-remediation snapshot; otherwise it documents an incorrect security posture.

Also applies to: 37-78

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@SECURITY_ANALYSIS.md` around lines 15 - 18, Update SECURITY_ANALYSIS.md to
reflect the implemented remediation: mark the findings about fork-unguarded
publishing, missing SECURITY.md/CODEOWNERS, and benchmark/downstream jobs
running on forks as remediated, or clearly label the document as a
pre-remediation snapshot. Ensure the report no longer presents these controls as
absent in the final security posture.