I attack my own release

The compliance gauntlet

A deterministic security regression suite that runs against a specific source version and produces a verdict plus evidence. Stages are mapped to NIST SSDF, OWASP ASVS, and CIS Controls, with a per-version control-mapping document. Real results from the v464 release gate:

Stage	Tooling	Result	Findings
SAST	Bandit + Semgrep	PASS	0 HIGH · 47 MEDIUM triaged · 48 LOW
Dependency audit (SCA)	pip-audit / OSV	PASS	0 advisories across 8 pinned deps
Secret scanning	gitleaks + custom Tenable-key patterns	PASS	0 leaks across the tree
License audit	pip-licenses	PASS	26 packages, 0 denied, 0 unknown
SBOM	CycloneDX 1.6	PASS	8 components, shipped with release
Data-at-rest probe	custom (perms, plaintext secrets, integrity tags)	PASS	0 findings across 45 state files
Binary scan · reproducibility · signing verify	post-build stages	gated on binary build	run at packaging time, not source gate

evidence: compliance/evidence/<version>/ · verdict file: GAUNTLET_SUMMARY.md · first run surfaced and fixed 3 issue classes before the PASS was declared — including SEC-001, a create-then-chmod race on the API credential file, fixed by creating it 0600 from the first syscall

Security architecture of the shipped product

• Credentials at rest: API keys stored 0600 on POSIX, owner-only ACL on Windows, created restricted (no chmod window).
• State integrity: application state is HMAC-SHA256 integrity-tagged JSON; sensitive payloads are Fernet-encrypted (AES-128-CBC + HMAC) under a per-install PBKDF2-HMAC-SHA256 key at 200,000 iterations.
• Tamper-evident logging: HMAC-chained audit log that detects modification across per-event and rotation boundaries.
• Signed distribution: Authenticode signing with an SSL.com IV (Individual Validation) certificate — key held in SSL.com's HSM, CodeSignTool signing gated by YubiKey TOTP — with an AV pre-submission pass before Store upload.
• Threat intel: the Zero-Day panel keys findings against the live CISA KEV catalog, carrying KEV metadata (date added, due date, vendor) into the operator view.
• Secrets hygiene: ASM bearer tokens are held in process memory only and never persisted; custom gitleaks patterns cover Tenable key formats, DPAPI blobs, and signing credential IDs.

Tamper evidence beyond hash chains

Hash-chained logs catch casual edits. For insider-grade tampering — an attacker who can rewrite the whole log and recompute every hash — I implemented the primitives that back Certificate Transparency and modern supply-chain attestation, and tested them against the specs' own vectors:

• RFC 6962 Merkle log over the audit trail: inclusion proofs, consistency proofs, leaf/node domain separation. The suite validates against the RFC's empty-tree vector and includes a simulated insider rewrite that the consistency proof must catch.
• Ed25519-signed tree heads with an independent-trust-root requirement. Tests cover body tampering and the forged-but-self-consistent STH case.
• RFC 3161 trusted timestamping, with a self-issued TSA rig so the path is testable offline.
• DSSE / in-toto provenance chains for artifact custody: PAE encoding validated against the spec's own example vector, a three-party hand-off chain, and a tamper battery — orphaned artifacts, removed and reordered links, forged signatures, untrusted signers, custody breaks.
• Two release-signing lanes: Windows Authenticode via SSL.com IV certificate (CodeSignTool, YubiKey-gated) and a Linux lane that GPG-detach-signs artifact hash manifests with OpenTimestamps anchoring — runbook'd and gated, with its final end-to-end attestation tracked openly as pending rather than quietly claimed.

code: ticket_time_machine/transparency.py · provenance.py · 50+ dedicated tests · runbook: production/SIGN_RELEASE_LINUX_RUNBOOK.md

Vulnerability disclosure policy

The project ships with a real SECURITY.md: private reporting channel, acknowledgment within 3 business days, reproduction within 7, patch within 30 calendar days for HIGH/CRITICAL findings and 90 otherwise, reporter credit in release notes, and a stated threat model covering the API connection, credential storage, state files, audit log, and signing chain. Only the latest release line is patched; older lines are retained for forensic purposes and marked unsupported.