Skip to content

Security Policy

Scope

In scope: the originet CLI and Rust library, the Python bindings under python/, the Dockerfile, the Compose file and the GitHub Actions workflows. The data comes from CAIDA's public RouteViews prefix-to-AS dataset; problems with the data itself belong to CAIDA.

Supported versions

The latest release on main. There are no maintained older branches.

Reporting a vulnerability

Use GitHub's private vulnerability reporting: https://github.com/estcarisimo/originet/security/advisories/new. Please include what is affected, how to reproduce it, the impact, and whether it is already public. You will get an acknowledgment within 7 days and an assessment within 14; fixes ship as a release. Please allow up to 90 days before public disclosure.

If private reporting is unavailable, contact the maintainer listed in .github/CODEOWNERS through GitHub with the subject [originet security].

What the tool does with the network and the file system

  • It downloads only from https://publicdata.caida.org (HTTPS, rustls), with an identifying User-Agent, and only when the needed index or snapshot is not cached. --offline disables downloads entirely.
  • Downloads go to a temporary file in the cache directory and are renamed into place, so an interrupted download never leaves a truncated file behind.
  • The cache directory is the platform cache dir (~/.cache/originet on Linux, ~/Library/Caches/originet on macOS), or --cache-dir / ORIGINET_CACHE_DIR.
  • Input files are read as text; gzip is detected by magic bytes and decompressed in memory in a streaming fashion. The tool never executes anything from its inputs.
  • No telemetry, no other endpoints.

What is in place

  • unsafe_code = "forbid" in every crate; clippy pedantic with -D warnings.
  • Supply chain: Cargo.lock and python/uv.lock committed and enforced (--locked), cargo deny (advisories, license allow-list, registry allow-list) on every PR and weekly, pip-audit on the bindings' dev tools, Dependabot for Cargo, uv, pip, Actions and Docker base images, actions pinned to commit SHAs, zizmor on the workflows, permissions: contents: read by default, CodeQL for Rust, Python and Actions.
  • Releases: tag must match the versions and sit on main; binaries with SHA-256 checksums; registries only through OIDC Trusted Publishing, no stored tokens.
  • Container: multi-stage build, Debian slim runtime with only ca-certificates, non-root user, no shell entrypoint.
  • Process: no direct pushes to main (protect-main ruleset), independent review of every PR (.github/REVIEW.md), CI green before merge.

Out of scope

Resource exhaustion by feeding the tool enormous input files on purpose (it streams but holds the whole result set in memory before writing), and findings in CAIDA's infrastructure.