Skip to content

Add SECURITY.md with AWS-LC threat model - #3421

Open
WesleyRosenblum wants to merge 8 commits into
aws:mainfrom
WesleyRosenblum:WesleyRosenblum/security-md
Open

Add SECURITY.md with AWS-LC threat model#3421
WesleyRosenblum wants to merge 8 commits into
aws:mainfrom
WesleyRosenblum:WesleyRosenblum/security-md

Conversation

@WesleyRosenblum

@WesleyRosenblum WesleyRosenblum commented Aug 11, 2026 •
edited
Loading

Copy link
Copy Markdown

Description of changes:

Adds a SECURITY.md in the same vein as s2n-tls and s2n-quic, following their section structure and reusing the shared AWS reporting language.

Also links the policy from README.md and CONTRIBUTING.md, both of which carry a security reporting section.

Testing:

Docs-only.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

@WesleyRosenblum
docs: Add SECURITY.md with AWS-LC threat model
703a76f 
AWS-LC has no repo-level security policy, so
github.com/aws/aws-lc/security/policy falls back to the aws/.github org
default. That default is reporting boilerplate with no threat model, so
reporters have no stated basis for deciding what is in scope.

Add a SECURITY.md adapted from the s2n-tls security policy, keeping its
section order and the shared AWS reporting language. The threat model is
rewritten for a cryptographic library: implementation defects are framed
for C, and timing and cache-based side channels are in scope rather than
out, since constant-time behavior is a core promise of libcrypto.

Link the policy from README and CONTRIBUTING, both of which carry a
security reporting section.
@WesleyRosenblum
WesleyRosenblum requested a review from a team as a code owner August 11, 2026 21:51
@WesleyRosenblum WesleyRosenblum changed the title [aws-lc] Add SECURITY.md with AWS-LC threat model Add SECURITY.md with AWS-LC threat model Aug 11, 2026
@WesleyRosenblum
WesleyRosenblum marked this pull request as draft August 11, 2026 21:53
@WesleyRosenblum
docs: Drop consumer list from threat model
4d16ab6 
Naming downstream consumers does no work in a shared responsibility
model, which is about which party is responsible for what rather than
who depends on the library. Removing it also drops the only claim in the
document that could not be verified from this repo's own source.
@WesleyRosenblum
docs: Drop redundant error-reporting responsibility
ce5e4b0 
The clause restated the Vulnerability Scope bullet on failures reported
as success without adding anything, and it broke the parallelism of a
sentence whose other items are affirmative capability promises. The
Vulnerability Scope bullet is the operative statement, since it tells a
reporter what to report.
@WesleyRosenblum
docs: Keep responsibility statement high level
69c91f5 
Zeroization and constant-time behavior are mechanisms for discharging a
duty, not the duty itself, and both are already listed as reportable
issues under Vulnerability Scope. Mixing them into the responsibility
statement put two abstraction levels in one sentence and duplicated the
scope list. State the duty instead, matching the register s2n-tls uses
in the same slot.
@WesleyRosenblum
docs: Drop editorial aside on misuse resistance
8ebb588 
The sentence explained why AWS-LC is easy to misuse instead of stating
whose duty it is, and compared the library unfavourably to an unnamed
alternative. Declining to promise misuse resistance is expressed by not
promising it and by the Vulnerability Scope carve-outs for invalid
arguments, deprecated compatibility APIs, and caller-selected
algorithms, all of which remain.
@WesleyRosenblum
WesleyRosenblum marked this pull request as ready for review August 11, 2026 22:27
@codecov-commenter

codecov-commenter commented Aug 11, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.24%. Comparing base (c528a49) to head (5e624f0).
⚠️ Report is 13 commits behind head on main.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #3421      +/-   ##
==========================================
- Coverage   78.43%   78.24%   -0.20%     
==========================================
  Files         696      698       +2     
  Lines      124514   124591      +77     
  Branches    17285    17289       +4     
==========================================
- Hits        97662    97484     -178     
- Misses      25925    26182     +257     
+ Partials      927      925       -2

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

justsmth
justsmth reviewed Aug 19, 2026
View reviewed changes

@justsmth justsmth left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Only minor concerns.

Comment thread README.md Outdated
Comment thread README.md Outdated
Comment thread SECURITY.md
Comment thread SECURITY.md Outdated
Comment thread SECURITY.md
Comment thread SECURITY.md
Comment thread CONTRIBUTING.md Outdated
Comment thread SECURITY.md Outdated
Comment thread SECURITY.md Outdated
@github-actions

github-actions Bot commented Aug 21, 2026

Copy link
Copy Markdown
Contributor

🔒 Security Review — View Report

Please review before merging.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@geedo0 geedo0 geedo0 approved these changes
@justsmth justsmth justsmth approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@WesleyRosenblum @codecov-commenter @geedo0 @justsmth