Security

Security

Security model for Tempify.

Threat model (brief)

Tempify runs Lua supplied by the template author in hooks. Users must trust templates - similar to curl | bash or Makefile targets.

Hook sandbox

Rule	Detail
Write access	Only within the build root
Read access	Build root + template files
Path traversal	../ and absolute paths outside → abort
Timeout	Configurable (--hook-timeout-ms, default from config)
Disable	--no-hooks / --accept-hooks no

E2E tests: tests/security/e2e/TempifyHookSandboxE2ETests.cpp

User control

• --accept-hooks ask (default with TTY): explicit consent
• Trust store: $XDG_DATA_HOME/tempify/trust/hooks.json
• tempify info shows hook presence before render

Sensitive data

• Questions with sensitive = true - masked input
• Lockfile redacts sensitive values in logs/output (E2E tested)

Validation

• Namespace and path validation in questions (validate callbacks)
• tempify validate / lint recommended before execution

Supply chain

• Prebyte pinned via CMake
• Releases published via GitHub Actions
• ReqPack catalogs: only add trusted repository URLs

Reporting

Report vulnerabilities via GitHub Security Advisories or private contact paths in the repository.

See also

Hooks (Users) · Hooks (Authors) · Tests & Quality