This is the v0.3 table from the execution plan, with what this repository actually does today. “Specified” means the trust specification describes the control and the code does not enforce it yet.
| Threat | Example | Control | In this tree | Residual risk |
|---|---|---|---|---|
| Feed tampering | A mirror edits an advisory | TUF signatures and hashes | v0.2.2 Ed25519 still rejects a tampered payload. TUF is specified only. | A stolen publisher key |
| Rollback or freeze | An old feed hides a new advisory | TUF timestamp and snapshot expiry | v0.2.2 rejects expiry, replay and a lower revision while local state is intact. TUF expiry values are specified only. | Someone who can roll back the local state file |
| Publisher compromise | Stolen CI credentials publish a false advisory | Sigstore identity pin, transparency log, namespace delegation | Specified. The pin is unset because no publishing workflow exists. | Medium, until the pin and the log check exist |
| Poisoned advisory | A valid signature and a wrong affected range | Cross-check sources, flag conflicts, never overwrite silently | ogde report marks disagreements contested and keeps both claims. It does not yet fetch the sources. |
Medium |
| Noise | A flood of low-quality advisories | Per-publisher limits and local thresholds | Local EPSS threshold and the existing --fail-on gate. No per-publisher rate limit. |
Medium |
| Inventory leak | A site list is sent to a third party | Local matching by default. OSV needs an explicit flag. | inventory and report do not open a network connection. scan-osv still requires --confirm-inventory-sharing. Collectors refuse secrets and do not record local paths. |
A person can still copy a report |
| Command injection | Advisory text is executed | Data only, strict schema, escaped output | Finding documents reject unknown fields, including command-shaped keys. Markdown escapes table cells. v0.2.2 feeds are still data. | A person might follow bad advice |
| Malicious OGDE release | A compromised package | Signed releases, pinned dependencies | Releases are not yet signed with Sigstore. Dependabot is enabled. | Medium |
| Secret collection | A collector reads wp-config.php, .env, a private key or a database |
Allow-listed fields and refusal tests | Tests fail if those paths are opened. There is no database client. | A local attacker racing the process can still change files under their own account |
Out of scope for v0.3, and not built: live attacker detection, automated patching, a multi-tenant dashboard, AI triage, and any remote action on a customer system.