[doc] Add security policy document

With suitable guidance, AI agents such as Claude Code are capable of
scanning effectively for potential vulnerabilities, and reporting them
in a concise and actionable format.

These tools are now widely available to malicious actors, and so any
vulnerabilities that they are capable of finding must be fixed now
before they are inevitably found and potentially exploited.

The recent batch of commits over the past week closes all potential
vulnerabilities that were detectable by either Opus 4.8 or Fable in
multiple passes over the code.  No serious security impact was found,
and there is nothing that would merit a UEFI Secure Boot revocation.

A concrete threat model is now documented, along with the explicit
bounds contracts for several internal APIs (such as ASN.1 parsing and
I/O buffer pointer manipulation).  Some entire classes of nominal
defect (e.g. technically undefined behaviour arising from constant
left shifts into the sign bit) have been eliminated.  False positives
that were raised several times and that could not be silenced through
reporting guidelines were fixed in the code, even when the code change
had no real-world impact.  It is now possible to ask an appropriately
instructed AI agent to search for vulnerabilities in the iPXE codebase
and to be reasonably confident that anything that it reports is worth
investigating further.

Add a security policy to formally document the expectations upon both
humans and AI agents in terms of reporting potential vulnerabilities,
and update the contribution guidelines to grant a limited exception to
the blanket ban on AI-generated text.

Signed-off-by: Michael Brown <mcb30@ipxe.org>

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 0e0a3e460ecb3719ec2e5a849309404e56f10100..98eae6ac27690604bdac0c683f913b412a86f8ed 100644 (file)
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -110,10 +110,14 @@ You are very welcome to use AI to help you understand the issue that
 you are experiencing but do not, under any circumstances, submit text
 or code that an AI has generated.
 
-Any AI-generated submissions will result in the submitting user being
-instantly and permanently banned from interacting with this or any
-related projects.  There will be no additional warnings, and there is
-no way to appeal against this ban.
+A limited exception to this blanket prohibition exists for reporting
+potential security vulnerabilities, as documented in the [security
+policy](SECURITY.md).
+
+Any other AI-generated submissions will result in the submitting user
+being instantly and permanently banned from interacting with this or
+any related projects.  There will be no additional warnings, and there
+is no way to appeal against this ban.
 
 
 [crypto]: https://ipxe.org/crypto

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644 (file)
index 0000000..a58f3c6
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,82 @@
+Security reporting
+==================
+
+Thank you for wanting to help to improve the security of iPXE!
+
+If you believe that you have found a vulnerability in iPXE, please
+first check that whatever you have found is still present in the
+latest commit on the [upstream][ipxe] master branch.
+
+Having checked that your finding is still present in iPXE, please then
+check against the defined [threat model][threats] document ([source
+file](src/doc/threat_model.dox)) to make sure that what you have found
+is within scope and worth reporting.  In particular, make sure to
+check the "Exclusions" portion of that document.
+
+Once you are sure that you have found something that is still present
+in iPXE and that falls within the threat model, please verify that the
+vulnerability is real.  A working exploit is not required, only a
+brief justification of the reasoning.
+
+Reporting
+---------
+
+Please [submit][secadv] any human-written vulnerability report as a
+GitHub Security Advisory against the upstream [iPXE][ipxe] repository.
+
+If the vulnerability report is generated by an AI agent, then you must
+instead [submit][aisecadv] the report as a GitHub Security Advisory
+against the separate [iPXE AI][aipxe] repository.
+
+Do not use public issue reports or pull requests to report suspected
+vulnerabilities.
+
+You can leave almost all fields blank in the report.  All that is
+required is the title and description, which should be no more than
+five to ten lines of text.  Verbose reports are likely to go unread,
+and verbose AI-generated reports will result in the responsible user
+being banned as per the "(Ab)use of AI" policy in the [contribution
+guidelines](CONTRIBUTING.md).
+
+A good example report (from a real historical example) is as follows:
+
+> `fcoe.c:522`: received FIP descriptor lengths are not validated
+>
+> `fcoe_fip_parse()` stores pointers to recognised FIP descriptor
+> types but never validates that descriptor length `desc_len` is
+> sufficient to hold the descriptor:
+> ```
+> if ( ( desc_type > FIP_RESERVED ) &&
+>      ( desc_type < FIP_NUM_DESCRIPTOR_TYPES ) ) {
+>         /* Use only the first instance of a descriptor */
+>         if ( descs->desc[desc_type] == NULL )
+>                 descs->desc[desc_type] = desc;
+>         continue;
+> }
+> ```
+
+That report contains exactly the right amount of information needed to
+identify and fix the problem.  There is no need to report extraneous
+information such as your compiler version, QEMU version, shoe size,
+favourite sandwich filling, a Dockerfile, etc.
+
+Credit
+------
+
+If the vulnerability is real, then you will receive at least a
+`Reported-by` credit in the commit that fixes it.  More complex
+investigations (requiring substantial time and effort on your part)
+will be upgraded to a `Debugged-by` credit.
+
+Please be sure to include both your real name and email address within
+the GitHub Security Advisory, so that we can give you the credit that
+you deserve.
+
+Many thanks for helping to improve iPXE for everyone!
+
+
+[aipxe]: https://github.com/ipxe/aipxe
+[aisecadv]: https://github.com/ipxe/aipxe/security/advisories/new
+[ipxe]: https://github.com/ipxe/ipxe
+[secadv]: https://github.com/ipxe/ipxe/security/advisories/new
+[threats]: https://dox.ipxe.org/threat_model.html