Protecting orchestr8 and Its Users

• Supported Versions
• Security Architecture
• Reporting Vulnerabilities
• Security Best Practices
• Automated Security
• Vulnerability Disclosure
• Security Champions

We actively maintain and provide security updates for the following versions:

Recommendation: Always use the latest version for best security posture.

orchestr8 implements defense-in-depth security with five layers of protection:

Threat Mitigation: Remote code execution, network-based attacks, unauthorized access

Threat Mitigation: Code injection, path traversal, denial of service

Threat Mitigation: Supply chain attacks, vulnerable dependencies, license violations

Threat Mitigation: Supply chain compromise, malicious code injection, unauthorized releases

Threat Mitigation: Undetected breaches, performance degradation, resource exhaustion

We take security seriously. Responsible disclosure helps us protect all users.

• ❌ Open public GitHub issues for security vulnerabilities
• ❌ Discuss vulnerabilities publicly before a fix is available
• ❌ Exploit vulnerabilities beyond proof-of-concept

• ✅ Report privately via approved channels (below)
• ✅ Provide detailed reproduction steps
• ✅ Allow time for coordinated disclosure
• ✅ Follow responsible disclosure principles

Choose one of these private reporting methods:

Email: security@orchestr8.builders

Subject: [SECURITY] Brief description

PGP Key: Download public key (optional but recommended)

Use GitHub's private vulnerability reporting:

Create Security Advisory

A great security report includes:

1. Summary
   - Brief description of the vulnerability
   - Type of vulnerability (e.g., XSS, RCE, path traversal)

2. Impact
   - What an attacker can achieve
   - Affected systems/components
   - Severity assessment (Critical/High/Medium/Low)

3. Reproduction Steps
   - Detailed, numbered steps to reproduce
   - Environment details (OS, Node.js version, etc.)
   - Sample payloads or proof-of-concept code

4. Affected Versions
   - Which versions are vulnerable
   - When the vulnerability was introduced (if known)

5. Suggested Fix (Optional)
   - Your recommendations for remediation
   - Patches or code samples (if available)

Example Template:

## Vulnerability: [Brief Description]

**Type**: Command Injection
**Severity**: High
**Affected Versions**: 8.0.0-rc1

### Impact
An attacker can execute arbitrary commands by crafting a malicious query...

### Steps to Reproduce
1. Install orchestr8 v8.0.0-rc1
2. Execute workflow with payload: `'; rm -rf / #`
3. Observe command execution...

### Suggested Fix
Sanitize all user input with...

We are committed to rapid response:

Note: Timelines may be extended for complex vulnerabilities requiring extensive testing.

We value security researchers and offer:

• ✅ Public acknowledgment (with your permission)
• ✅ CVE credit for valid vulnerabilities
• ✅ Hall of Fame listing on our security page
• ✅ Swag for significant findings (orchestr8 t-shirts, stickers)

# ✅ Verify source
git clone https://github.com/seth-schultz/orchestr8.git
cd orchestr8

# ✅ Check integrity (if downloading release)
sha256sum -c CHECKSUMS.txt

# ✅ Review code before production use
cat plugins/orchestr8/src/index.ts

# ✅ Use latest version
npm install  # Installs latest stable

# ✅ Never commit secrets
echo ".env" >> .gitignore
echo ".env.local" >> .gitignore

# ✅ Use environment variables
export ORCHESTR8_API_KEY="secret"

# ✅ Set proper file permissions
chmod 600 .env
chmod 700 plugins/orchestr8/config/

# ✅ Use production log level
export LOG_LEVEL="warn"  # Not "debug"

// ✅ Configure token limits
const config = {
  maxTokens: 3000,  // Prevent resource exhaustion
  cacheSize: 200,   // Limit memory usage
  cacheTTL: 14400   // 4 hours
};

// ✅ Monitor logs
tail -f logs/orchestr8.log | grep ERROR

// ✅ Keep dependencies updated
npm audit
npm update

# ✅ Run security checks locally
npm run lint
npm run type-check
npm audit

# ✅ Use pre-commit hooks
./scripts/install-git-hooks.sh

# ✅ Never commit sensitive data
git diff --cached  # Review before commit

# ✅ Sign commits (optional)
git config --global commit.gpgsign true

• Input validation on all user-provided data
• Output encoding to prevent XSS
• Parameterized queries to prevent injection
• Proper error handling (no stack traces to users)
• Authentication/authorization checks
• Rate limiting where applicable
• Secrets not hard-coded
• Dependencies up-to-date

We run continuous security scanning to catch issues early:

Tool: npm audit
Frequency: Every PR + Daily scheduled run
Threshold: Fail on HIGH/CRITICAL vulnerabilities
Action: Auto-create PR with fixes (Dependabot)

Tool: CodeQL
Frequency: Every push to main + Weekly scheduled scan
Languages: TypeScript, JavaScript
Queries: security-extended, security-and-quality
Action: Create GitHub Security Alert

Tools: Gitleaks, TruffleHog
Frequency: Every commit (pre-commit hook) + Every PR
Patterns: API keys, passwords, tokens, private keys
Action: Fail build, prevent merge

Tool: OpenSSF Scorecard
Frequency: Weekly
Checks: 24 security practices
Threshold: Maintain score ≥ 7.0/10
Action: Automated improvement PRs

Tool: license-checker
Frequency: Every PR
Allowed: MIT, Apache-2.0, BSD-3-Clause
Prohibited: GPL, AGPL, proprietary
Action: Fail build on non-compliant licenses

We maintain full transparency on security issues:

1. Fix Developed - Vulnerability patched in private repository
2. Release Prepared - New version created with fix
3. Advisory Published - GitHub Security Advisory created
4. CVE Assigned - CVE ID obtained from GitHub/MITRE
5. Public Release - Fix published, advisory made public
6. User Notification - Email to security mailing list
7. Blog Post - Detailed post-mortem published

Active Advisories: View on GitHub

CVE Database: Search NIST NVD

All security fixes are documented in CHANGELOG.md with:

• 🔒 [SECURITY] tag
• CVE ID (if assigned)
• Severity level
• Affected versions
• Mitigation steps

We welcome external security audits. If you're interested:

1. Contact: security@orchestr8.builders with your proposal
2. Access: We'll provide test environments and documentation
3. Disclosure: Coordinated disclosure of findings
4. Recognition: Public acknowledgment (with your permission)

• Security Scanning Results - View latest scans
• OpenSSF Scorecard - Supply chain security score
• Dependency Graph - View all dependencies
• Security Policy - This document
• Code of Conduct - Community standards

Questions about security?

📧 Email: security@orchestr8.builders 🔒 GitHub Security Advisories: Report Privately 📖 Documentation: plugins/orchestr8/docs/

Last Updated: November 11, 2025 Version: 1.0.0