Security advisories
Where advisories are published, which versions get fixes, and how fast.
No security advisory has been published against grith to date.
When one is, it appears in three places: GitHub Security
Advisories on grith-ai/grith, the release
notes for the version carrying the fix, and CHANGELOG.md. Watch the repository's releases to be
told about them.
Supported versions
| Version | Status |
|---|---|
| v0.3.1 | Current release. Fixes land here. |
| v0.2.5 | Previous release. Security fixes only. |
| Anything older | Not supported. |
There is no backport branch. Upgrading is the fix path.
Severity and fix targets
| Severity | What it covers | Fix target |
|---|---|---|
| Critical | Remote code execution, privilege escalation, a supervisor bypass giving unrestricted syscall access | 48 hours |
| High | Exfiltration past the filters, audit-log tampering, secret exposure in API responses | 5 business days |
| Medium | Denial of service, non-secret information disclosure, a filter bypass for specific patterns | 15 business days |
| Low | Minor information leakage, UI issues, documentation errors with security implications | Scheduled, not expedited |
Researchers who report a confirmed issue are credited in the release notes and the changelog, unless they would rather stay anonymous.
Hearing about a fix
[general] update_check defaults to true. The REPL and grith run offer an interactive upgrade
prompt when a newer release exists; grith exec prints a single line to stderr naming the new
version and the install command, and carries on. Both need a terminal on stderr, so redirected logs
and CI stay clean - the prompt additionally needs a terminal on stdin, because it has a question to
ask. Setting GRITH_NO_UPDATE_CHECK to any value turns both off.
There is no grith update subcommand. See Updating grith for what the
prompt does, and where it refuses.
Before you install anything
Every release asset is signed with keyless sigstore, and every tarball ships a SHA-256 file, a
CycloneDX SBOM and SLSA build provenance. Verifying releases has the
exact sha256sum and cosign commands.
See also
- Responsible disclosure - how to report one.
- Limitations - known limits, which are not advisories.
- Verifying releases