Mixle Core security

Document ID: CORE-DOC-SECURITY-001 Version scope: 0.8.x development Owner: PRJ-CORE

The public vulnerability-reporting policy is in ../SECURITY.md. Do not report a vulnerability through a public issue.

Threat model

Core processes caller data, serialized model artifacts, optional backend objects, external data-source configuration, generated expressions, and distributed execution metadata. Relevant threats include unsafe deserialization, path traversal, secret leakage, dependency compromise, resource exhaustion, untrusted code execution, and corrupted or substituted artifacts.

Data handling

  • Treat caller data and artifact metadata as untrusted at boundaries.

  • Do not log secrets, raw credentials, private datasets, or unrestricted model payloads.

  • Validate paths, sizes, shapes, dtypes, schemas, and digests before use.

  • Prefer safe structured formats. Never load an untrusted pickle or executable artifact merely because it has a Mixle filename.

  • Code-execution deserialization is opt-in, per call, as of 0.8.1. Every loader whose payload can execute code on load requires the caller to pass the literal True for its trust flag – load_encoded(path, encoder=..., trusted=True) for encoded-data payloads, and the corresponding explicit flags on embedder and artifact loads. Truthy stand-ins (1, "true", numpy.True_) are rejected so a config value or environment string cannot silently become consent, and the flag is not sticky: nothing a library call does can turn it on for a later call. Pass it only for a path you control; the stored integrity digest detects truncation and tampering, not a file substituted wholesale.

  • Record provenance and applicable license or privacy constraints when data or models leave the caller process.

Dependencies and optional backends

Base dependencies are declared in pyproject.toml; optional backends expand the attack and supply-chain surface. Pin release environments, review dependency changes, generate applicable inventories, and test the installed combination. A missing optional dependency must fail at its boundary without masking a different nested import failure.

Release security automation audits both the isolated base-wheel environment and the machine-checked all runtime-feature union, retaining separate candidate/wheel-bound CycloneDX inventories. A scoped Bandit gate reviews Mixle and release-script source for medium-or-higher confidence/severity findings. Dependency advisories and source analysis are distinct gates.

The secret gate runs Gitleaks against the complete Git history from a full-depth checkout. The fast source-tree gate additionally recognizes common cloud, registry, payment, collaboration, JWT, and private-key credential formats in the current tracked tree. Synthetic redaction fixtures are allowlisted only by exact value.

Every third-party action in a release workflow is pinned to a full commit identifier. Its adjacent version comment is review context, not executable identity.

Disclosure and response

Use the private reporting channel in ../SECURITY.md. Preserve reproduction details and affected versions, limit disclosure, create a scoped fix and regression test, assess downstream consumers, and publish an advisory and patched release when required.