The following advisories were identified and remediated prior to their respective releases. Documented here for transparency.

⚠️ Reference architecture notice: CAGE is a reference architecture and is not deployed to production. These advisories are tracked for completeness and to ensure the codebase accurately represents the security posture claimed in associated research publications.

Please do not report security vulnerabilities through public GitHub issues.

To report a security vulnerability, please use the GitHub Security Advisory "Report a Vulnerability" feature.

Alternatively, you may email the maintainers directly. Please include:

• A description of the vulnerability and its potential impact
• Steps to reproduce the issue
• Any proof-of-concept code (if applicable)
• Your suggested fix (if you have one)

You should receive a response within 5 business days. If you do not receive a response, please follow up to ensure your report was received.

We follow a coordinated disclosure model:

1. You report the vulnerability privately.
2. We confirm receipt and begin investigation within 5 business days.
3. We develop and test a fix.
4. We release the fix and publish a security advisory.
5. You may publicly disclose the vulnerability after the fix is released, or after 90 days from the initial report — whichever comes first.

The following are in scope for security reports:

• Remote code execution in the governance gateway or compliance bridge
• Authentication/authorisation bypass in the governance pipeline
• Governance tier bypass (violations of the NoDirectBind invariant)
• Injection vulnerabilities (prompt injection, SQL injection, etc.)
• Cryptographic weaknesses in the Cloud KMS signing, kid-resolved trust anchors, development-only software signers (Ed25519 / HMAC-SHA256), routing seals, or the SHA-256 hash-chain implementation
• Control Barrier Function (CBF) race conditions or invariant violations
• Secrets or credentials exposed in the repository

The following are out of scope:

• Vulnerabilities in third-party dependencies (report these upstream)
• Denial-of-service attacks requiring physical access
• Social engineering attacks
• Issues in documentation only

CAGE is a domain-agnostic governance substrate designed for regulated environments generally; the shipped example domains (finance and healthcare) and the selectable jurisdictional postures (US_FED, EU_ECB, APAC_MAS, LOCAL) determine which regulatory controls are in scope for a given deployment. Key security controls are documented in:

• docs/security/SECURITY_STATUS.md — full security posture, NIST RMF status, and all open POA&M items
• docs/operations/KEY_ROTATION.md — cryptographic key lifecycle and rotation runbooks (SC-12 / IA-5)
• docs/architecture/GATEWAY_ARCHITECTURE.md
• deployment/k8s/K8S_SECURITY_HARDENING.md
• COMPLIANCE.md

Note: CAGE v3.x is a reference architecture. Regulated-environment deployers must conduct their own risk assessment before production use. See docs/security/SECURITY_STATUS.md for the complete posture breakdown and pre-deployment checklist.

Replay-attack closure: KMS-signed reconciliation payloads embed a signed_at Unix timestamp. The verifier (KMSGovernanceSigner.verify() in kms_signer.py) rejects any payload where now - signed_at > 300 s (MAX_KMS_PAYLOAD_AGE_SECONDS).

Strict Replication & Fence Epoch Hardening: In production (CAGE_ENV=prod), ControlBarrierFunction asserts synchronous replica replication (CAGE_STRICT_REPLICATION=true). If replica synchronization fails during WAIT, the local balance debit is automatically rolled back (rollback_state(cost)) and fails closed. Monotonic safety:fence_epoch counters prevent stale-replica balance replays.

Audit Durability & Citation Guarantee: validate_evidence_stream_preconditions() is posture-based: under an enforcing posture (anything but dev/test/ci; an unset CAGE_ENV is production) it halts startup if EVIDENCE_STREAM_ENABLED=false, or if EVIDENCE_CHAIN_BLOCKING=false without an explicit CAGE_ALLOW_NONBLOCKING_PROD=true. The gateway lifespan also starts the sink via start_evidence_sink() and fails closed, so no routing seal or ConsequenceGateway EXECUTE verdict is issued without durable evidence commitment to the tamper-evident log. In the compliance bridge, EvidenceCustodian signs batches with EVIDENCE_KMS_KEY and writes them via put_if_absent() to WORM cold storage, while CustodyVerifier (evidence_verifier.py) re-verifies the archive on EVIDENCE_VERIFY_INTERVAL_S against kid-resolved trust anchors and gates OSCAL assessment citations (OSCAL_REQUIRE_VERIFIED_CUSTODY=true).

Header-spoofing closure: Caller identity is never read from application-layer data. X-Agent-ID headers, body-supplied agent_id fields, and the X-CAGE-Routing-Seal header are not accepted as authentication. The sole source of truth is the l5d-client-id header, which the Linkerd inbound proxy sets from the verified mTLS peer certificate (or strips when there is none). The gateway accepts exactly one such header matching CAGE_TRUSTED_CLIENT_IDENTITIES, in every environment; anything else fails closed with 403 rather than falling back to an anonymous principal. The mesh AuthorizationPolicy independently admits only the advisor's service account (POAM-2026-080).

Ambient-credential closure: Outbound API credentials are no longer held by adapters. They are requested per dispatch from a CredentialBrokerAdapter, keyed on the calling agent's SVID and the tool name, injected as request headers at dispatch time, and held only in local scope. Credential values never appear in ActuationReceipt, findings, or HTTP response bodies — asserted by test_credential_headers_not_in_audit_record.

Masking is prefix-preserving, not total. Log masking applies value[:8] + "****". For an Authorization: Bearer <token> header only the scheme survives, but a broker that returns a bare-token header will leak the first 8 characters of the secret into logs. Brokers should return scheme-prefixed header values.

The following patterns are strictly forbidden in production code and will be rejected in review:

• PROHIBITED: secret = os.environ.get("API_KEY", "default-secret")
• REQUIRED: Fail-closed validation asserting os.environ["API_KEY"] exists and meets minimum entropy length (>= 32 chars).

• PROHIBITED: subprocess.run(command, shell=True)
• REQUIRED: subprocess.run(shlex.split(command)) with direct argument lists.

• PROHIBITED: requests.get(url, verify=False)
• REQUIRED: Explicit TLS certificate verification (verify=True).

• PROHIBITED: pickle.loads(data) or unconstrained yaml.load(data)
• REQUIRED: json.loads(data) or yaml.safe_load(data).

All prohibited patterns are enforced via static grep checks, pre-commit hooks, CI security jobs, and targeted unit regression suites in tests/test_*_security.py.