pmat 2.213.14

PMAT - Zero-config AI context generation and code quality toolkit (CLI, MCP, HTTP)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68

# Security Policy

## Supported Versions

| Version | Supported          |
| ------- | ------------------ |
| 2.210.x | :white_check_mark: |
| 2.200.x | :white_check_mark: |
| < 2.200 | :x:                |

## Reporting a Vulnerability

**DO NOT** open a public issue for security vulnerabilities.

### Responsible Disclosure

1. Email security concerns to: security@paiml.com
2. Include:
   - Description of the vulnerability
   - Steps to reproduce
   - Potential impact assessment
   - Any suggested fixes (optional)

### Response Timeline

| Stage | Timeline |
|-------|----------|
| Initial Response | 48 hours |
| Triage | 7 days |
| Fix Development | 30 days |
| Public Disclosure | 90 days (coordinated) |

## Security Measures

### Code Analysis

- **cargo-audit**: Run weekly, blocking on HIGH severity
- **cargo-deny**: License and dependency policy enforcement
- **Clippy**: All warnings treated as errors in CI

### Supply Chain Security

- Dependencies pinned in `Cargo.lock`
- Minimal dependency policy (< 300 direct dependencies)
- No unmaintained dependencies (> 2 years without update)

### Input Validation

- All file paths validated against directory traversal
- User input sanitized before shell execution
- Maximum file size limits enforced (100MB default)

## Security Audit History

| Date | Auditor | Scope | Findings |
|------|---------|-------|----------|
| 2025-01 | Internal | Full codebase | 0 critical, 2 medium (fixed) |

## Falsifiable Security Claims

Per Popper's demarcation criterion, our security claims are testable:

| Claim | Test Method | CI Verification |
|-------|-------------|-----------------|
| No command injection | Fuzz testing with special chars | `cargo fuzz run cli_args` |
| No path traversal | Unit tests with `../` patterns | `cargo test path_validation` |
| Audit clean | `cargo audit` exit code 0 | GitHub Actions weekly |
| Memory safe | No `unsafe` without justification | `cargo clippy -D unsafe_code` |