What counts as a vulnerability
CTRLRun sits in the execution path of consequential actions, so anything that breaks one of these is a security issue rather than a bug:- An action executes that the policy should have denied.
- An approval authorizes an action other than the exact one a human saw.
- A consumed, expired or mismatched approval is accepted.
- The same logical effect is reserved twice, in any interleaving, across threads, processes or hosts.
- An unknown execution outcome is recorded as
failed. - A principal acts outside its grant, or a delegation widens one.
- A receipt does not reflect what happened.
What is a documented limit
These are stated in the threat model and are not vulnerabilities, though if you think one is stated too generously, say so:- A compromised process, host or Python environment.
- A malicious administrator with write access to the policy file or the store.
- A remote that lies about what it did.
- A compromised approver: CTRLRun proves what was approved, not that the human was right.
- An executor that raises
NotExecutedafter the remote acted. - Code that bypasses the decorator entirely.
- Data exfiltration through reads the policy allows.
What happens to a report
An assessment, then a fix with a test that fails before it and passes after, then a release. If a fix is warranted you are credited in the release notes unless you ask not to be. Where the finding is about a claim rather than the code, the claim changes: a sentence that promised more than the code does is a defect in this project’s terms, and how this is built explains why.Supported versions
CTRLRun is pre-1.0 and only the latest release receives fixes.Next
- Threat model · The receipt chain.
- How this is built: what has and has not been reviewed.
- Get started · Why.