Synthetic Open Schema is an open specification stewarded by Ideatives Inc.

This document outlines the security policy for the specification and reference implementations.

Security issues may include:

• Specification ambiguities that could lead to security vulnerabilities
• Issues in reference implementations (Python model/runner)
• Documentation gaps affecting secure usage
• Validation bypass opportunities

DO NOT open public GitHub issues for security vulnerabilities.

Instead, report security issues privately:

1. Email: Open a private security advisory via GitHub

   • Go to https://github.com/syntheticopenschema/spec/security/advisories/new
   • Fill in the advisory template

2. Alternative: Create a private GitHub issue

   • Mark as security-sensitive
   • Include detailed description

• Description of the vulnerability
• Affected spec version(s) or implementation(s)
• Steps to reproduce
• Potential impact
• Suggested fix (if available)

We aim to respond to security reports within:

• Initial Response: 3 business days

  • Acknowledge receipt
  • Confirm scope (spec vs implementation)
  • Provide initial assessment

• Status Update: 7 days

  • Investigation progress
  • Estimated fix timeline
  • Coordinated disclosure date (if applicable)

• Resolution: 30 days (target)

  • Specification clarification or
  • Implementation fix or
  • Documentation update

We follow responsible disclosure practices:

1. Private Resolution: Fix developed privately
2. Implementer Notification: Alert known implementations
3. Grace Period: 14-day advance notice for implementers
4. Public Disclosure: Coordinated public announcement

Public security advisories will include:

• Affected versions
• Description of vulnerability
• Impact assessment
• Mitigation steps
• Fixed versions
• Credit to reporter (if desired)

The specification includes security guidance for:

• How to handle sensitive data in check definitions
• Environment variable substitution
• Secrets storage recommendations

• Certificate validation requirements
• Custom CA trust stores
• insecureSkipVerify warnings (development only)

• Field validation rules
• Type constraints
• Regex patterns for safety

• Safe handling of user-provided values
• Script execution sandboxing (browser checks)
• Command injection risks

See individual check specifications for detailed security considerations.

The Python reference implementation follows security best practices:

• Pydantic strict validation
• No eval() or dynamic code execution
• Dependency security scanning
• Regular security updates

Implementers should:

• Validate all inputs strictly
• Sandbox script execution (browser checks)
• Implement timeout protections
• Follow principle of least privilege
• Document security assumptions
• Provide security contact

CVEs (Common Vulnerabilities and Exposures) may be issued for:

• Critical security flaws in reference implementations
• Specification ambiguities exploited in the wild
• Widespread implementation vulnerabilities

• CVEs assigned through GitHub Security Advisories
• Coordinated with affected parties
• Published after fix availability

Security-relevant specification clarifications:

• Issued as minor version updates
• Backward compatible
• Documented in changelog
• Announced via GitHub releases

Reference implementation security updates:

• Published as patch releases
• Security advisory on GitHub
• Notification to known users
• Documented in release notes

1. Credentials: Use environment variables, not hardcoded secrets
2. URLs: Validate and sanitize user-provided URLs
3. Scripts: Sandbox browser script execution
4. Timeouts: Always set reasonable timeouts
5. Validation: Use strict validation (extra="forbid")

1. Input Validation: Validate all YAML/JSON strictly
2. Resource Limits: Enforce memory and CPU limits
3. Network Security: Use TLS where appropriate
4. Logging: Don't log sensitive data
5. Dependencies: Keep dependencies updated
6. Isolation: Run checks in isolated environments

1. Access Control: Restrict who can define checks
2. Code Review: Review check definitions before deployment
3. Monitoring: Monitor for suspicious check behavior
4. Auditing: Log check creation and modifications
5. Rotation: Rotate credentials regularly

• Maintainer: @dmonroy
• GitHub Security Advisories: https://github.com/syntheticopenschema/spec/security/advisories
• Issues: https://github.com/syntheticopenschema/spec/issues (non-security)

We appreciate responsible disclosure from the security community. Security researchers who report valid vulnerabilities will be credited in:

• GitHub Security Advisories
• Release notes
• Hall of Fame (if established)

Last Updated: 2026-02-07 Version: 1.0