If you discover a security vulnerability in EnvForge, please report it responsibly:

1. Do NOT open a public GitHub issue
2. Email: security@envforge.dev (or use GitHub Security Advisories)
3. Include: description, reproduction steps, potential impact
4. We aim to respond within 48 hours

• File integrity — Atomic writes prevent corruption. SHA-256 hash verification.
• No data loss — Soft-delete only. Original content preserved as comments.
• Secret masking — Sensitive values never displayed in plain text by default.
• Encryption at rest — Age X25519 encryption for sensitive values. Mandatory by construction for all 13 secret providers.
• Credential encryption policy — Every provider declares its encryption posture via the SecretProvider trait (compile-time enforced). No provider returns plaintext credentials to disk without explicit, audited justification.
• Credential isolation — All provider credentials passed via environment variables or stdin pipes (never CLI flags) to prevent /proc/PID/cmdline leakage.
• Error sanitization — CLI error output is sanitized to redact credential patterns before logging or display.
• Recovery key — A second age keypair is generated on first run. Store it offline to recover encrypted credentials if the primary key is lost.

• Runtime memory — Decrypted values exist in memory during session
• Terminal history — CLI commands with values may appear in shell history
• Clipboard — Copied values are in system clipboard (not cleared automatically)
• CLI binary integrity — EnvForge does not verify GPG signatures of provider CLIs. A compromised binary in PATH could exfiltrate secrets. Verify binary integrity yourself.
• Cache on disk — Secret cache files are encrypted at rest with 0600 permissions, but are plaintext TOML within the file. Protect your home directory.
• ARGV bypass in debug builds — ENVFORGE_UNSAFE_ARGV=* disables secret detection in debug builds only. This path is audited at Critical severity and rejected in release builds. The old ENVFORGE_UNSAFE_ARGV=1 format is blocked entirely.

• Algorithm: X25519 (via age crate, plugin feature disabled)
• Key storage: ~/.config/envforge/age.key with 0600 permissions (auto-corrected if permissive). Override via ENVFORGE_AGE_KEY (inline) or ENVFORGE_AGE_KEY_FILE (custom path).
• Recovery key: ~/.config/envforge/age-recovery.key — generated on first run, store offline.
• Encrypted format: ENC[age:base64data] stored in shell files and credentials
• Key generation: Automatic on first encrypt command; auto-generated keypair with explicit permission hardening
• Credential encryption: Mandatory by construction for all providers except those with explicit NotSupported justification
• RUSTSEC-2024-0433 mitigation: age crate compiled without plugin feature; arbitrary code execution vector eliminated

EnvForge automatically audits dependencies daily using cargo audit and cargo deny via GitHub Actions. Key security-relevant dependencies:

• age — Encryption (well-audited, widely used, plugin feature disabled)
• sha2 — File integrity hashing
• tempfile — Atomic write operations
• serde_norway — YAML serialization (replaces deprecated serde_yaml)

We employ several automated tools to maintain a high security standard:

• Cargo Audit: Checks for known vulnerabilities in our dependency tree daily.
• Cargo Deny: Enforces license compliance and bans problematic crates.
• Dependabot: Automatically manages dependency updates to keep us on the latest secure versions.
• CodeQL: Performs static analysis to detect potential security vulnerabilities in the codebase.
• CLI Binary Audit: Weekly CI check verifying installed versions of the 13 provider CLI binaries against minimum requirements.

All 13 secret providers use external CLI binaries. EnvForge passes credentials via environment variables or stdin (never CLI flags) to prevent credential leakage via /proc/PID/cmdline.