Skip to content

Security: chrisriv10/CodebaseColony

Security

docs/SECURITY.md

Security review — 0.3.0

This review covers repository analysis, artifact parsing, trend persistence, live refresh, Electron IPC, local tool launch, and Git/GitHub workflows. Codebase Colony is a local desktop developer tool, not a sandbox for executing untrusted repositories; its analysis path nevertheless avoids executing repository code.

Trust boundaries reviewed

  • Renderer IPC accepts fixed action variants, fixed editor IDs, fixed GitHub targets, bounded strings, and repository-relative paths. It does not accept executables, commands, remotes, or external URLs.
  • Files opened by editor, Explorer, and terminal actions pass both lexical containment and canonical-path containment checks. A symlink inside the repository cannot redirect these actions outside the selected root.
  • Filesystem discovery skips symbolic links and generated/dependency/VCS directories and stops at 6,000 files. Text reads stop at 1.5 MiB per file and binary-looking files remain metadata-only.
  • Artifact discovery uses a fixed allowlist. Files are limited to 8 MiB, symbolic-link artifacts are ignored, XML DOCTYPE/entity/stylesheet declarations are rejected, and parsed record counts are capped.
  • Git commands use execFile argument arrays, timeouts, output caps, -- path separation where applicable, and a fixed 500-commit analysis window. Analysis performs read-only Git commands only.
  • Mutating Git operations remain explicit and serialized. Hooks and commit signing are disabled for app-initiated commits/pushes; terminal prompting is disabled. Reset, discard, checkout, rebase, stash, force push, and automatic synchronization are absent.
  • GitHub URLs are derived in Electron from a recognized GitHub origin; renderer-provided external URLs are never opened.
  • Trend persistence contains bounded derived numbers and mission IDs only. Writes go to Electron’s app-owned userData directory, use an opaque repository identity, and can be reset per repository.
  • Live refresh is opt-in, watches one validated root, filters generated/VCS/dependency/temp paths, coalesces bursts, and can only trigger the read-only analyzer.
  • The renderer remains sandboxed with context isolation, no Node integration, blocked popups/navigation, and the existing Content Security Policy.

Resource limits

Surface Limit
Discovered repository files 6,000
Rendered buildings 1,200 with deterministic priority retention
Source text read 1.5 MiB per file
Coverage/test artifact 8 MiB per artifact
Coverage/test records Format-specific caps up to 250,000 line/assertion records
Git analysis latest 500 commits, detected by reading at most 501
File diff shown 160,000 characters
Stored trends 40 scans and 100 achievements per repository
Watch event path disclosure first 50 coalesced paths per burst

Verification

The automated suite covers traversal, canonical existing paths, hostile XML declarations, analyzer fallbacks, rename-aware Git history, hook suppression, isolated fetch/push, repository paths containing spaces, and watcher ignore policy. npm audit reports no known dependency vulnerabilities for the pinned lockfile at release preparation time.

Residual limitations

  • XML readers are purpose-built for bounded JUnit/Cobertura subsets rather than general XML. Unsupported structures are ignored or reported rather than interpreted.
  • Explicit Git staging can invoke clean filters already configured in the user’s Git environment; this is why staging is separated from analysis and never automatic.
  • Windows installer artifacts are unsigned in this project configuration. Users may see SmartScreen warnings until a publisher adds Authenticode signing.
  • A repository can still consume CPU within the documented file/text limits. The reproducible profiler exists to track regressions, and UI rendering separately retains/culls high-value structures.

There aren't any published security advisories