Skip to content

Security: cachekit-io/cachekit-core

Security

SECURITY.md

Security Policy

Supported Versions

Version Supported
0.1.x Yes

Reporting a Vulnerability

Do not open a public GitHub issue for security vulnerabilities.

Instead, please report security issues via:

  1. Email: security@cachekit.io
  2. GitHub Security Advisories: Report a vulnerability

What to Include

  • Description of the vulnerability
  • Steps to reproduce
  • Potential impact
  • Suggested fix (if any)

Response Timeline

Stage Timeline
Initial response 48 hours
Triage & assessment 7 days
Fix development 14-30 days
Public disclosure After fix released

Security Model

Cryptographic Guarantees

Component Algorithm Notes
Encryption AES-256-GCM AEAD via ring crate
Key Derivation HKDF-SHA256 RFC 5869 compliant
Integrity xxHash3-64 Non-cryptographic (corruption detection)
Nonce Counter + Random IV Unique per encryption

Threat Model

This crate protects against:

  • Data tampering: GCM authentication tags (when encryption enabled); xxHash3 detects accidental corruption only
  • Data disclosure: AES-256-GCM encryption (when enabled)
  • Key compromise isolation: HKDF domain separation per tenant
  • Decompression bombs: Size limits + ratio validation
  • Memory disclosure: zeroize on drop for key material

This crate does not protect against:

  • Side-channel attacks on the host system
  • Compromise of the master key
  • Denial of service via resource exhaustion (partial protection only)
  • Attacks requiring physical access

Dependencies

Security-critical dependencies are audited via cargo-deny:

cargo deny check advisories

See deny.toml for the full security policy.

Software Bill of Materials

A CycloneDX 1.6 SBOM is generated by cargo-sbom during publish and attested against the packaged crate via actions/attest-sbom. The attestation is the verifiable artifact — verify it against the crate as published:

# Download the published crate, then verify the SBOM attestation against it.
curl -sSLO https://static.crates.io/crates/cachekit-core/cachekit-core-0.4.0.crate
gh attestation verify cachekit-core-0.4.0.crate --repo cachekit-io/cachekit-core \
  --predicate-type https://cyclonedx.org/bom

Note the predicate type carries no version suffix: actions/attest-sbom records CycloneDX as https://cyclonedx.org/bom regardless of spec version (the version lives in the document's own specVersion). Provenance is attested separately under https://slsa.dev/provenance/v1 against the same subject.

GitHub releases for this repository carry no SBOM file as a downloadable asset. Immutable releases are enabled here, which seals a release's assets at publish time, so an SBOM cannot be attached after the fact. Use the attestation above.

Vulnerability Disclosure History

No vulnerabilities have been disclosed yet.

There aren't any published security advisories