michaelweber
8cd2c35aeb
Removing some overly-aggressive security findings that called out the entire point of the project as security issues 🤣
2.4 KiB
Security Policy
WasmForge is an offensive-security toolchain that compiles Go and .NET programs to WebAssembly and packages them as polymorphic native binaries. By design, it produces binaries that resist static analysis and runtime detection by common AV/EDR products. Please keep this in mind when deciding whether to file a security report.
Supported Versions
WasmForge is a pre-1.0 project. Only the current main branch is supported.
Reporting a Vulnerability
Email security@praetorian.com. Please include:
- A description of the issue and its impact
- A minimal reproduction (command line, source snippet, sample WASM, etc.)
- Affected commit SHA(s) on
main - Whether you intend to disclose publicly, and on what timeline
We will acknowledge your report within 3 business days and aim to respond substantively within 10 business days. We prefer coordinated disclosure with a 90-day window from the date of acknowledgement; we are happy to negotiate longer windows for complex issues.
In Scope
We treat the following as security issues and triage them accordingly:
- Supply-chain risks in the build pipeline — anything that lets
compiling a wasmforge-built binary inject code into the developer's
host machine beyond the documented
go build/dotnet publishsteps.
Out of Scope
The following are not security issues — they are either intended behavior or outside the project's threat model:
- A specific AV / EDR product detects a wasmforge-built binary. Producing detectable binaries is the explicit purpose of the tool; improving evasion is a feature backlog item, not a security report.
- Ghost profile collisions — a wasmforge binary's
gopclntabresembles a real product (Traefik, Caddy, etc.). The bundled profiles are sampled from public binaries; this is intentional. - AV detection of guest payloads embedded inside a wasmforge binary. The guest content's signatures (Sliver implants, etc.) are not part of the wasmforge attack surface.
- Defender / SmartScreen reputation gating of unsigned or newly-signed binaries.
- Vulnerabilities in tooling we depend on (Go toolchain, .NET SDK, WASI SDK, osslsigncode, etc.) that are not introduced or amplified by wasmforge. Report those upstream.
Disclosure
Once a fix lands on main, we will credit reporters in the commit
message and/or release notes unless they request otherwise.