Skip to content

🛡️ Sentinel: Create security journal avoiding security theater #19

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
seonghobae wants to merge 1 commit into
base: master
Choose a base branch
from
Open

🛡️ Sentinel: Create security journal avoiding security theater #19

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .jules/sentinel.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
## 2024-07-01 - Avoid Security Theater in Pure Math Packages
**Vulnerability:** N/A (General finding for this repo)
**Learning:** This is a purely statistical mathematical package (`nonnest2`) performing likelihood calculations and matrix operations. It has no web endpoints, network access, or file I/O operations that parse untrusted external data. As such, adding argument type bounds or structural validations (which are standard statistical error handling) should NOT be presented as security enhancements. Treating them as such creates "security theater".
**Prevention:** Do not create security PRs for standard error checking in mathematical libraries without an actual vector of exploitation.
Loading