Skip to content

Security: ReviewToolkits/cpython-security-toolkit

Security

SECURITY.md

Security Policy — cpython-security-toolkit

This document covers two distinct security topics:

  1. Security findings generated by this toolkit (CPython stdlib bugs) → see WORKING_WITH_MAINTAINERS.md
  2. Security vulnerabilities in this toolkit itself → see below

Reporting vulnerabilities in this toolkit

The toolkit handles untrusted input (crafted archives in corpus fixtures, subprocess calls in the reproducer engine) and generates scripts that are then executed. A vulnerability in the toolkit code itself is possible and should be reported privately.

Report vulnerabilities in this toolkit via GitHub's private vulnerability reporting:

Security tab → "Report a vulnerability"

Do not open a public issue for vulnerabilities in the toolkit code itself.

What counts as a vulnerability in this toolkit

  • Code execution via crafted finding JSON — if the reproducer engine can be tricked into executing attacker-controlled code by a maliciously crafted finding JSON file
  • Path traversal in reproducer output — if a reproducer template writes files outside ./reproductions/<finding-id>/
  • Command injection in script arguments — if any script's argument handling allows shell metacharacters to reach a subprocess call
  • Unsafe temporary file handling — race conditions or symlink attacks in the tempfile usage within the reproducer engine

What is NOT a vulnerability here

  • The corpus positive fixtures demonstrating CPython bugs — they are intentionally crafted to demonstrate boundary violations and are expected to produce dangerous output when run against unpatched CPython. They are not bugs in this toolkit.
  • High API cost from a full /scan run — the cost and time estimates in the README are accurate; using the toolkit as intended is not an abuse scenario.
  • False positives from the scan scripts — a wrong finding is a quality issue, not a security vulnerability. File a regular issue.

Supported versions

Toolkit version Supported
0.2.x (current) ✅ Yes
0.1.x ❌ No — upgrade to 0.2.x

CPython security findings

If you used this toolkit to find a potential security vulnerability in CPython's standard library, do not report it here. Follow the process in WORKING_WITH_MAINTAINERS.md:

  1. Pre-triage with a trusted CPython developer
  2. File with security@python.org
  3. Do not discuss publicly until the PSRT authorizes disclosure

Opening a GitHub issue or PR in this repository to disclose a CPython finding is a disclosure anti-pattern. The right venue is security@python.org.

There aren't any published security advisories