Security
Security and disclosure
AMMP is a security boundary, so a flaw in it matters. Please report privately, never in a public issue.
Where to report
The specification
Email resero-labs@proofpoint.com. Say which draft revision and which wire version you were reading.
amap-connector-codex
Use GitHub's private vulnerability reporting on the repository.
For a problem with a release itself, such as a manifest that pins a vulnerable commit in amap-release, email resero-labs@proofpoint.com.
If you aren't sure which component is at fault, send it to resero-labs@proofpoint.com anyway. A misrouted report is much better than an unsent one, and a partial report is worth sending.
What counts as a vulnerability in the specification
- A clause that can't be satisfied securely, or two clauses that force an implementer to choose between them.
- A schema that permits what the prose forbids. Implementations validate against the schema, so the disagreement is a defect even when the prose is right.
- An obligation with no conformance fixture. A field no fixture exercises is a field no implementer can prove they handle.
- An attack the trust model doesn't account for, especially anything that lets an agent influence a routing or identity decision that belongs to the runtime.
A flaw in an implementation goes to that implementation's own repository, using the contacts above.
What happens next
You should get an acknowledgement that the report arrived. A defect in the specification is fixed in a later revision of the Internet-Draft, with fixtures in the same change, and recorded in the changelog.