Red team: November 2026

Ouverte
  • Quelque chose ne va pas ?
#1,494 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
5/5
Temps estimé
Plus d'une semaine
Accessibilité débutants
5/100
Type d'issue
Documentation
Clarté
À clarifier
Activité
Active
Domaine
security

Piste de recherche

This is a maintainer tracking issue for a monthly red-team pass, not a code change. The process is defined in docs/specs/security-audit.md under "Red team"; read that section first. Done means every checklist item is ticked, confirmed findings are fixed or documented, and the summary sections below are filled in. Only maintainers with access to the private ledger can do this work.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

red-team

The monthly red-team pass (docs/specs/security-audit.md → "Red team"): an open-ended review of the code and the published guarantees, without the FAIL IF lines, on at least two model families. Findings go to the private ledger first; this issue records the pass once its findings are fixed or documented and disclosed.

Checklist
  • Build one stripped tree per engine from main, and record the commit reviewed.
  • Run each engine: Claude through Anthropic's Cyber Verification Program, Codex through OpenAI's Daybreak program (optionally Gemini).
  • Run each engine's second round, which proves its claims against the real code.
  • Verify every claimed break with a separate reviewer.
  • File each confirmed item in the ledger, fix it in a plain-worded PR, and close it citing the PR.
  • Record the pass in the private red-team/runs/.
  • After the nightly audit discloses the fixed findings, summarize the pass here and close.
The most serious findings

Nothing found allowed an account takeover or remote access to a terminal. Confirm or replace this sentence, and say why it holds. Everything rated above low is described below. Which release fixes it, and which releases were affected.

Severity What could happen Who could do it Fixed in
Severity What could happen, in one bolded sentence. How, in plain words. Who could do it. PR

Low-severity findings, fixed or documented: each in a clause with its PR, or none.

This month
  • Passes: each pass's commit and engines.
  • Fixed: PRs.
  • Documented as not defended or a known gap: PRs.
  • Disclosed: security-audit-finding.
  • Process changes it led to: PRs, or none.
Langage dominant
TypeScript
Étoiles
5
Forks
1
Merge moyen
13 h 39 min
PR mergées (30 j)
457

Préparer son environnement

Ce projet ne fournit ni conteneur de développement, ni Dockerfile, ni guide de contribution : l'installation est à votre charge. Commencez par son README, et consultez notre guide de la première contribution pour les étapes générales.

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de diffplug/dormouse

Toutes les issues de diffplug/dormouse

Issues similaires

Plus d'issues TypeScript

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.