The following advisories were identified and remediated prior to their respective releases. Documented here for transparency.

⚠️ Reference architecture notice: CAGE is a reference architecture and is not deployed to production. These advisories are tracked for completeness and to ensure the codebase accurately represents the security posture claimed in associated research publications.

Please do not report security vulnerabilities through public GitHub issues.

To report a security vulnerability, please use the GitHub Security Advisory "Report a Vulnerability" feature.

Alternatively, you may email the maintainers directly. Please include:

• A description of the vulnerability and its potential impact
• Steps to reproduce the issue
• Any proof-of-concept code (if applicable)
• Your suggested fix (if you have one)

You should receive a response within 5 business days. If you do not receive a response, please follow up to ensure your report was received.

We follow a coordinated disclosure model:

1. You report the vulnerability privately.
2. We confirm receipt and begin investigation within 5 business days.
3. We develop and test a fix.
4. We release the fix and publish a security advisory.
5. You may publicly disclose the vulnerability after the fix is released, or after 90 days from the initial report — whichever comes first.

The following are in scope for security reports:

• Remote code execution in the governance gateway or compliance bridge
• Authentication/authorisation bypass in the governance pipeline
• Governance tier bypass (violations of the NoDirectBind invariant)
• Injection vulnerabilities (prompt injection, SQL injection, etc.)
• Cryptographic weaknesses in the Cloud KMS signing, HMAC-SHA256 fallback, or SHA-256 hash-chain implementation
• Control Barrier Function (CBF) race conditions or invariant violations
• Secrets or credentials exposed in the repository

The following are out of scope:

• Vulnerabilities in third-party dependencies (report these upstream)
• Denial-of-service attacks requiring physical access
• Social engineering attacks
• Issues in documentation only

CAGE is a domain-agnostic governance substrate designed for regulated environments generally; the shipped example domains (finance and healthcare) and the selectable jurisdictional postures (US_FED, EU_ECB, APAC_MAS, LOCAL) determine which regulatory controls are in scope for a given deployment. Key security controls are documented in:

• docs/security/SECURITY_STATUS.md — full security posture, NIST RMF status, and all open POA&M items
• docs/operations/KEY_ROTATION.md — cryptographic key lifecycle and rotation runbooks (SC-12 / IA-5)
• docs/architecture/GATEWAY_ARCHITECTURE.md
• deployment/k8s/K8S_SECURITY_HARDENING.md
• COMPLIANCE.md

Note: CAGE v3.x is a reference architecture. Regulated-environment deployers must conduct their own risk assessment before production use. See docs/security/SECURITY_STATUS.md for the complete posture breakdown and pre-deployment checklist.

Replay-attack closure: KMS-signed reconciliation payloads embed a signed_at Unix timestamp. The verifier (KmsSigner.verify()) rejects any payload where now - signed_at > 300 s (MAX_KMS_PAYLOAD_AGE_SECONDS).

Strict Replication & Fence Epoch Hardening: In production (CAGE_ENV=prod), ControlBarrierFunction asserts synchronous replica replication (CAGE_STRICT_REPLICATION=true). If replica synchronization fails during WAIT, the local balance debit is automatically rolled back (rollback_state(cost)) and fails closed. Monotonic safety:fence_epoch counters prevent stale-replica balance replays.

Audit Durability Guarantee: validate_evidence_stream_preconditions() halts startup in production if EVIDENCE_CHAIN_BLOCKING=false, ensuring no routing seal is issued without durable evidence commitment to the tamper-evident log.

Header-spoofing closure: Agent identity is no longer read from application-layer data. X-Agent-ID / X-SPIFFE-ID headers and body-supplied agent_id fields are ignored; the sole source of truth is the SPIFFE URI SAN of the verified mTLS client certificate. Because every downstream governance tier keys off agent_id, a forgeable identity previously undermined tier selection, quota accounting, and A2A authorization simultaneously. Unauthenticated requests now fail closed with 401 on both ingress paths rather than falling back to an anonymous principal.

Ambient-credential closure: Outbound API credentials are no longer held by adapters. They are requested per dispatch from a CredentialBrokerAdapter, keyed on the calling agent's SVID and the tool name, injected as request headers at dispatch time, and held only in local scope. Credential values never appear in ActuationReceipt, findings, or HTTP response bodies — asserted by test_credential_headers_not_in_audit_record.

Masking is prefix-preserving, not total. Log masking applies value[:8] + "****". For an Authorization: Bearer <token> header only the scheme survives, but a broker that returns a bare-token header will leak the first 8 characters of the secret into logs. Brokers should return scheme-prefixed header values.

The following patterns are strictly forbidden in production code and will be rejected in review:

• PROHIBITED: secret = os.environ.get("API_KEY", "default-secret")
• REQUIRED: Fail-closed validation asserting os.environ["API_KEY"] exists and meets minimum entropy length (>= 32 chars).

• PROHIBITED: subprocess.run(command, shell=True)
• REQUIRED: subprocess.run(shlex.split(command)) with direct argument lists.

• PROHIBITED: requests.get(url, verify=False)
• REQUIRED: Explicit TLS certificate verification (verify=True).

• PROHIBITED: pickle.loads(data) or unconstrained yaml.load(data)
• REQUIRED: json.loads(data) or yaml.safe_load(data).

All prohibited patterns are enforced via static grep checks, pre-commit hooks, CI security jobs, and targeted unit regression suites in tests/test_*_security.py.