From 49c2456da834b604d32adaea9b43521c5c1e08c7 Mon Sep 17 00:00:00 2001 From: sajal-n <81651631+sajal-n@users.noreply.github.com> Date: Thu, 27 Nov 2025 18:52:30 -0500 Subject: [PATCH 01/27] Add Guardon self-assessment documentation Added a comprehensive self-assessment document for Guardon, detailing project overview, security boundaries, goals, system architecture, threat model, secure development practices, and known limitations. Signed-off-by: sajal-n <81651631+sajal-n@users.noreply.github.com> Signed-off-by: Sajal Nigam --- .../guardon/guardon-self-assessment.md | 235 ++++++++++++++++++ 1 file changed, 235 insertions(+) create mode 100644 community/assessments/projects/guardon/guardon-self-assessment.md diff --git a/community/assessments/projects/guardon/guardon-self-assessment.md b/community/assessments/projects/guardon/guardon-self-assessment.md new file mode 100644 index 000000000..e2811aa2a --- /dev/null +++ b/community/assessments/projects/guardon/guardon-self-assessment.md @@ -0,0 +1,235 @@ +# Guardon — CNCF TAG-Security Self-Assessment + +**Project:** Guardon +**Type:** Browser-based Kubernetes YAML & Policy Validator +**Website:** https://github.com/sajalkn/guardon +**Contact:** security@guardon.dev +**Assessment Version:** v1.0 +**Last Updated:** 2025-XX-XX + +--- + +## 1. Project Overview + +Guardon is a **fully client-side browser extension** (Chrome/Edge/Brave) that performs: + +- Kubernetes YAML validation +- Misconfiguration detection +- Kyverno-policy evaluation +- Inline annotations on GitHub/GitLab + +Guardon shifts Kubernetes security **far left**, helping developers identify misconfigurations **before** they reach CI pipelines or clusters. +All validation happens locally inside the browser using **JavaScript + WebAssembly**. +No backend, no cloud service, and **no user data ever leaves the machine**. + +--- + +## 2. Security Boundary + +Guardon has a strict and minimal security boundary: + +- Runs entirely within browser WebExtension APIs +- No backend infrastructure +- No telemetry or analytics +- No transmission of YAML or policies to external systems +- Kyverno engine executes inside a local WebAssembly sandbox +- No Kubernetes cluster access, no secrets, no tokens +- Only interacts with user-selected YAML files or GitHub/GitLab DOM content + +**Trusted Computing Base (TCB):** + +- Browser (Chrome/Brave/Edge) +- Guardon WebExtension JS/TS code +- Embedded Kyverno-WASM engine +- Local storage for rules and configuration + +--- + +## 3. Goals and Non-Goals + +### **Goals** +- Detect Kubernetes misconfigurations early, at authoring time +- Enforce governance standards using Kyverno rules +- Provide deterministic and reproducible validation results +- Work entirely offline and locally +- Improve developer productivity by embedding checks inside workflow +- Offer zero-trust handling of user data (no outbound calls) + +### **Non-Goals** +- Not a runtime security tool +- Not a replacement for PSP, PSA, Gatekeeper, or Kyverno in-cluster +- Not a network or API security solution +- Does not detect runtime attacks, malware, or CVEs +- Does not handle supply-chain validation outside YAML/policies +- Does not attest image provenance or signatures + +--- + +## 4. System Architecture + +Guardon is composed of four main modules: + +1. **Content Script** + - Injected into GitHub/GitLab UI + - Extracts YAML sections from PR diffs or files + - Renders inline annotations + +2. **Worker Engine** + - Runs the Kyverno WASM policy evaluator + - Performs Kubernetes schema validation + - Executes custom rules from user-defined collections + +3. **Background Service Worker** + - Handles cross-tab messaging + - Optional background fetch of referenced YAMLs + - Manages rule bundles + +4. **Extension UI** + - Popup for validation + - Options page for rule configuration + - Rule editor and custom bundles + +--- + +## 5. Actors and Data Flow + +### **Actors** +- **Developer**: Uses Guardon while browsing YAML on GitHub/GitLab +- **Browser**: Provides sandboxed execution environment +- **Local Guardon Engine**: Performs validation +- **Kyverno-WASM**: Evaluates policies locally +- **Rule Sources**: User-imported Kyverno rules stored locally + +### **Data Flow Summary** + +1. User views Kubernetes YAML on GitHub/GitLab +2. Guardon content script extracts YAML into memory +3. Data is sent to the Worker Engine (local only) +4. Worker evaluates schema + policies +5. Results returned to content script +6. Inline annotations displayed +7. No data is logged, stored externally, or transmitted + +--- + +## 6. Critical Security Functions + +### **Critical (Non-Configurable)** +- Kubernetes schema validation +- Local Kyverno-WASM policy execution +- Secure sandboxing of rule engine +- YAML isolation and strict parsing +- Immutable validation results +- No-network guarantee +- No access to browser cookies, tokens, or secrets +- Extension CSP preventing inline script execution + +### **Security-Relevant (Configurable)** +- Custom rule bundle imports +- Background fetch helper for related YAMLs +- Organization-specific governance packs +- Optional CIS/NIST best-practice packages + +--- + +## 7. Threat Model (High-Level) + +### Guardon mitigates: +- Misconfigured workloads (privileged pods, hostPath, missing limits, etc.) +- RBAC over-permission +- Pod Security violations +- YAML structural errors +- Drift from organizational governance standards +- Incorrect multi-document YAML compositions +- Unsafe defaults (no resource limits, insecure capabilities) + +### Guardon does NOT mitigate: +- Runtime container escape +- Host/kernel compromise +- Image-level supply-chain attacks +- Network-level exploits +- Malicious browser extensions +- Insider threat or malicious developer intent +- Attacks on GitHub/GitLab itself + +Full threat model available in `guardon-threat-model.md`. + +--- + +## 8. Secure Development Practices + +- Public source code on GitHub +- MIT License +- CI pipeline with: + - Static code analysis (ESLint) + - npm audit + - WASM linting +- Automated dependency scanning +- Reproducible build plan +- Release bundles signed with GitHub provenance +- Mandatory code review for PRs +- Vulnerability reporting: security@guardon.dev +- SECURITY.md published in repository + +--- + +## 9. Vulnerability Reporting & Incident Response + +**Contact:** security@guardon.dev +**Policy:** SECURITY.md follows TAG-Security template + +Incident handling workflow: + +1. Triage and reproduce issue +2. Assign CVSS score +3. Apply patch in a protected branch +4. Issue temporary private release for reporters if needed +5. Public security advisory via GitHub Security Advisories +6. Patch release with clear changelog +7. Update community channels + +Guardon follows a **90-day disclosure window** or faster if required. + +--- + +## 10. Known Limitations + +- Depends on browser WASM performance +- Limited by GitHub/GitLab DOM stability +- Multi-GB YAML files not supported +- Will not detect runtime or CVE-level vulnerabilities +- No distributed policy cache (local only) +- Not compatible with Firefox yet (pending MV3 support) + +--- + +## 11. Roadmap (Security-Focused) + +- Signed rule packs +- Rule provenance verification +- In-extension SBOM viewer +- WASM sandbox hardening +- AI-assisted policy recommendations +- Support for JetBrains/VScode extensions +- Organization-managed rule registries +- Policy drift detection across repos + +--- + +## Appendix + +### Example Use Cases +- Detect privileged pod before code review +- Validate RBAC roles from GitHub UI +- Local evaluation of Kyverno policies before commits +- Quick governance compliance checks for microservices teams + +### Example Policies +- “Disallow hostPath” +- “Require resource limits/requests” +- “Block privileged containers” +- “Prevent hostNetwork usage” + +--- + +**End of Document** From 49115fbcfde6323c98a0084ef853ff3a930d8e0a Mon Sep 17 00:00:00 2001 From: sajal-n <81651631+sajal-n@users.noreply.github.com> Date: Thu, 27 Nov 2025 18:53:14 -0500 Subject: [PATCH 02/27] Add Guardon threat model documentation Signed-off-by: sajal-n <81651631+sajal-n@users.noreply.github.com> Signed-off-by: Sajal Nigam --- .../projects/guardon/guardon-threat-model.md | 149 ++++++++++++++++++ 1 file changed, 149 insertions(+) create mode 100644 community/assessments/projects/guardon/guardon-threat-model.md diff --git a/community/assessments/projects/guardon/guardon-threat-model.md b/community/assessments/projects/guardon/guardon-threat-model.md new file mode 100644 index 000000000..d34164091 --- /dev/null +++ b/community/assessments/projects/guardon/guardon-threat-model.md @@ -0,0 +1,149 @@ +# Guardon — Threat Model (STRIDE-Based) + +**Methodology:** STRIDE +**Scope:** Browser extension + WASM policy engine + YAML parsing +**Version:** v1.0 + +--- + +## 1. Assets + +- Kubernetes YAML documents +- User-defined policy bundles +- Validation results +- Local rule storage +- Browser’s trust environment +- WASM engine integrity +- Guardon extension code + +--- + +## 2. Actors + +### **Primary** +- Developer (authorized) +- Guardon Extension +- Kyverno-WASM engine +- Browser sandbox + +### **Secondary** +- GitHub/GitLab interface (untrusted but expected) +- External rule sources (trusted only through user import) + +### **Adversaries** +- Malicious developer +- Compromised browser extension ecosystem +- Supply-chain attacker +- Browser exploit attacker +- User with malicious intent +- Malicious JavaScript in GitHub/GitLab DOM + +--- + +## 3. STRIDE Analysis + +### **S — Spoofing** +**Risks:** +- Impersonation of rule sources +- Malicious WASM module tampering +- Fake extension versions + +**Mitigations:** +- Signed releases +- No remote rule fetching +- CSP restricting script injection +- User-controlled rule import only + +--- + +### **T — Tampering** +**Risks:** +- Modification of rules in local storage +- DOM-based manipulation of annotations +- Altering validation logic via supply-chain JS + +**Mitigations:** +- Local storage schema validation +- Immutable rule parsing +- Deterministic WASM behavior +- Content-Security-Policy enforcement + +--- + +### **R — Repudiation** +**Risks:** +- No server logs (intentional design) +- Hard to prove who changed rule bundles + +**Mitigations:** +- User confirmation flows for rule changes +- Optional local audit log (planned) +- Clearly documented local-only behavior + +--- + +### **I — Information Disclosure** +**Risks:** +- YAML content exposure if extension leaks +- Cross-tab data leakage +- Extension accessing unrelated browser data + +**Mitigations:** +- Strict MV3 permissions +- Zero telemetry design +- No cookie/storage access +- No external endpoints +- Runtime isolation via WASM + +--- + +### **D — Denial of Service** +**Risks:** +- Large YAML files freeze extension +- Malicious rule packs causing infinite evaluation +- DOM mutation overload from CI diffs + +**Mitigations:** +- Worker timeouts +- Rule execution limits +- Graceful fallback mode + +--- + +### **E — Elevation of Privilege** +**Risks:** +- Extension gaining access to tokens +- WASM escaping sandbox +- DOM injection attacks escalating permissions + +**Mitigations:** +- No access to cookies, tokens, or storage +- Browser sandbox isolation +- Restricted extensions permissions (read-only) +- Strict WASM runtime boundaries + +--- + +## 4. Out-of-Scope Threats + +- Kubernetes runtime attacks +- Host/kernel exploitation +- Network/TLS attacks +- GitHub/GitLab authentication flows +- Supply-chain attacks unrelated to Guardon code +- Cross-extension interference + +--- + +## 5. Attack Surfaces + +- Browser DOM +- Local rule storage +- WebAssembly engine +- YAML parser +- Extension update mechanism + +--- + +## 6. High-Level Data Flow Diagram (DFD) + From d9b005c6f67d8851474ecd577063f58e77757a7c Mon Sep 17 00:00:00 2001 From: sajal-n <81651631+sajal-n@users.noreply.github.com> Date: Thu, 27 Nov 2025 18:54:48 -0500 Subject: [PATCH 03/27] Add metadata.yaml for Guardon project details Signed-off-by: sajal-n <81651631+sajal-n@users.noreply.github.com> Signed-off-by: Sajal Nigam --- .../projects/guardon/metadata.yaml | 36 +++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 community/assessments/projects/guardon/metadata.yaml diff --git a/community/assessments/projects/guardon/metadata.yaml b/community/assessments/projects/guardon/metadata.yaml new file mode 100644 index 000000000..cccd53594 --- /dev/null +++ b/community/assessments/projects/guardon/metadata.yaml @@ -0,0 +1,36 @@ +project: + name: Guardon + type: Browser Extension / Kubernetes Policy & YAML Validator + repo: "https://github.com/sajalkn/guardon" + maintainers: + - name: Sajal Nigam + email: security@guardon.dev + role: Lead Maintainer + +security: + contact: security@guardon.dev + policy: "https://github.com/sajalkn/guardon/security/policy" + incident_response: "https://github.com/sajalkn/guardon/docs/incident-response.md" + +assessment: + version: "v1.0" + date: "2025-XX-XX" + reviewers: [] + related_documents: + - guardon-self-assessment.md + - guardon-threat-model.md + +runtime: + environment: Browser WebExtension (Chrome/Edge/Brave) + executes_locally: true + uses_wasm: true + collects_telemetry: false + requires_backend: false + +boundaries: + inbound_data: + - Kubernetes YAML + - User-imported Kyverno rules + outbound_data: [] + network_access: false + cluster_access: false From 2993b8f466b01bea364ab29f923c28d22174d8dc Mon Sep 17 00:00:00 2001 From: sajal-n <81651631+sajal-n@users.noreply.github.com> Date: Thu, 27 Nov 2025 18:57:07 -0500 Subject: [PATCH 04/27] Update website and contact information Signed-off-by: sajal-n <81651631+sajal-n@users.noreply.github.com> Signed-off-by: Sajal Nigam --- .../assessments/projects/guardon/guardon-self-assessment.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/community/assessments/projects/guardon/guardon-self-assessment.md b/community/assessments/projects/guardon/guardon-self-assessment.md index e2811aa2a..e1d367cd1 100644 --- a/community/assessments/projects/guardon/guardon-self-assessment.md +++ b/community/assessments/projects/guardon/guardon-self-assessment.md @@ -2,8 +2,8 @@ **Project:** Guardon **Type:** Browser-based Kubernetes YAML & Policy Validator -**Website:** https://github.com/sajalkn/guardon -**Contact:** security@guardon.dev +**Website:** [https://github.com/sajalkn/guardon](https://chromewebstore.google.com/detail/jhhegdmiakbocegfcfjngkodicpjkgpb?utm_source=item-share-cb) +**Contact:** sajalnigam@gmail.com **Assessment Version:** v1.0 **Last Updated:** 2025-XX-XX From 39ea0d1a73772cc098b5167c7fe0ee81053ab61b Mon Sep 17 00:00:00 2001 From: sajal-n <81651631+sajal-n@users.noreply.github.com> Date: Thu, 27 Nov 2025 18:59:10 -0500 Subject: [PATCH 05/27] Update project website link format in self-assessment Signed-off-by: sajal-n <81651631+sajal-n@users.noreply.github.com> Signed-off-by: Sajal Nigam --- .../assessments/projects/guardon/guardon-self-assessment.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/community/assessments/projects/guardon/guardon-self-assessment.md b/community/assessments/projects/guardon/guardon-self-assessment.md index e1d367cd1..cbe5886ce 100644 --- a/community/assessments/projects/guardon/guardon-self-assessment.md +++ b/community/assessments/projects/guardon/guardon-self-assessment.md @@ -2,7 +2,7 @@ **Project:** Guardon **Type:** Browser-based Kubernetes YAML & Policy Validator -**Website:** [https://github.com/sajalkn/guardon](https://chromewebstore.google.com/detail/jhhegdmiakbocegfcfjngkodicpjkgpb?utm_source=item-share-cb) +**Website:** [Guardon](https://chromewebstore.google.com/detail/jhhegdmiakbocegfcfjngkodicpjkgpb?utm_source=item-share-cb) **Contact:** sajalnigam@gmail.com **Assessment Version:** v1.0 **Last Updated:** 2025-XX-XX From 1e8f29bd7394722ae5ddd1eb87b134e5e0eb694e Mon Sep 17 00:00:00 2001 From: sajal-n <81651631+sajal-n@users.noreply.github.com> Date: Thu, 27 Nov 2025 19:02:11 -0500 Subject: [PATCH 06/27] Update contact email for vulnerability reporting Signed-off-by: sajal-n <81651631+sajal-n@users.noreply.github.com> Signed-off-by: Sajal Nigam --- .../assessments/projects/guardon/guardon-self-assessment.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/community/assessments/projects/guardon/guardon-self-assessment.md b/community/assessments/projects/guardon/guardon-self-assessment.md index cbe5886ce..6be301427 100644 --- a/community/assessments/projects/guardon/guardon-self-assessment.md +++ b/community/assessments/projects/guardon/guardon-self-assessment.md @@ -175,7 +175,7 @@ Full threat model available in `guardon-threat-model.md`. ## 9. Vulnerability Reporting & Incident Response -**Contact:** security@guardon.dev +**Contact:** sajalnigam@gmail.com **Policy:** SECURITY.md follows TAG-Security template Incident handling workflow: From dedcc762e5dea3e16a5ebceeebcb453fe5902d48 Mon Sep 17 00:00:00 2001 From: sajal-n <81651631+sajal-n@users.noreply.github.com> Date: Fri, 28 Nov 2025 11:39:39 -0500 Subject: [PATCH 07/27] Update maintainer email in metadata.yaml Signed-off-by: sajal-n <81651631+sajal-n@users.noreply.github.com> Signed-off-by: Sajal Nigam --- community/assessments/projects/guardon/metadata.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/community/assessments/projects/guardon/metadata.yaml b/community/assessments/projects/guardon/metadata.yaml index cccd53594..0f1de7b91 100644 --- a/community/assessments/projects/guardon/metadata.yaml +++ b/community/assessments/projects/guardon/metadata.yaml @@ -4,11 +4,11 @@ project: repo: "https://github.com/sajalkn/guardon" maintainers: - name: Sajal Nigam - email: security@guardon.dev + email: sajalnigam@gmail.com role: Lead Maintainer security: - contact: security@guardon.dev + contact: sajalnigam@gmail.com policy: "https://github.com/sajalkn/guardon/security/policy" incident_response: "https://github.com/sajalkn/guardon/docs/incident-response.md" From 2deab8760e93ce68ea7df681474e7e563d5fc210 Mon Sep 17 00:00:00 2001 From: sajal-n <81651631+sajal-n@users.noreply.github.com> Date: Fri, 28 Nov 2025 11:40:52 -0500 Subject: [PATCH 08/27] Update last updated date in self-assessment document Signed-off-by: sajal-n <81651631+sajal-n@users.noreply.github.com> Signed-off-by: Sajal Nigam --- .../assessments/projects/guardon/guardon-self-assessment.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/community/assessments/projects/guardon/guardon-self-assessment.md b/community/assessments/projects/guardon/guardon-self-assessment.md index 6be301427..8f3031587 100644 --- a/community/assessments/projects/guardon/guardon-self-assessment.md +++ b/community/assessments/projects/guardon/guardon-self-assessment.md @@ -5,7 +5,7 @@ **Website:** [Guardon](https://chromewebstore.google.com/detail/jhhegdmiakbocegfcfjngkodicpjkgpb?utm_source=item-share-cb) **Contact:** sajalnigam@gmail.com **Assessment Version:** v1.0 -**Last Updated:** 2025-XX-XX +**Last Updated:** 2025-11-28 --- From 71ca18737f2f1f851479cb2106f0fd2029383b8b Mon Sep 17 00:00:00 2001 From: sajal-n <81651631+sajal-n@users.noreply.github.com> Date: Sun, 30 Nov 2025 16:12:37 -0500 Subject: [PATCH 09/27] Enhance Guardon self-assessment with feature details Expanded project overview with detailed features of Guardon. Signed-off-by: sajal-n <81651631+sajal-n@users.noreply.github.com> Signed-off-by: Sajal Nigam --- .../guardon/guardon-self-assessment.md | 22 +++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/community/assessments/projects/guardon/guardon-self-assessment.md b/community/assessments/projects/guardon/guardon-self-assessment.md index 8f3031587..72f88562f 100644 --- a/community/assessments/projects/guardon/guardon-self-assessment.md +++ b/community/assessments/projects/guardon/guardon-self-assessment.md @@ -13,10 +13,24 @@ Guardon is a **fully client-side browser extension** (Chrome/Edge/Brave) that performs: -- Kubernetes YAML validation -- Misconfiguration detection -- Kyverno-policy evaluation -- Inline annotations on GitHub/GitLab +- **Instant Kubernetes YAML validation** — Flags security misconfigurations as you browse GitHub/GitLab, with no CI/CD required. + +- **Schema-aware checks** — Validates manifests against uploaded Kubernetes OpenAPI/CRD schemas to ensure required fields and type safety. + +- **Customizable rule engine** — Supports JSON-based rules and Kyverno policy import for organization-specific governance standards. + +- **Multi-document YAML support** — Handles complex manifests containing multiple resources in a single file. + +- **Actionable fix suggestions** — Generates copy-paste-ready YAML patches for every violation. + +- **Dark mode UI** — Provides a seamless experience across day and night workflows. + +- **Offline-first** — All validation runs fully locally in your browser with zero network calls. + +- **Manual paste & validation** — Validate any YAML by pasting it directly into the extension popup, even outside GitHub/GitLab. + +- **Enterprise-ready** — Import/manage custom rules, preview Kyverno policies, and enforce governance at organizational scale. + Guardon shifts Kubernetes security **far left**, helping developers identify misconfigurations **before** they reach CI pipelines or clusters. All validation happens locally inside the browser using **JavaScript + WebAssembly**. From 64858afb8815b6dd8ffa2ebd1201ce30bd41c6fa Mon Sep 17 00:00:00 2001 From: sajal-n <81651631+sajal-n@users.noreply.github.com> Date: Sun, 30 Nov 2025 16:22:06 -0500 Subject: [PATCH 10/27] Revise Guardon self-assessment documentation Updated the Guardon self-assessment documentation to clarify the architecture and functionality, including changes to the validation engine and policy execution details. Signed-off-by: sajal-n <81651631+sajal-n@users.noreply.github.com> Signed-off-by: Sajal Nigam --- .../guardon/guardon-self-assessment.md | 54 +++++++++---------- 1 file changed, 25 insertions(+), 29 deletions(-) diff --git a/community/assessments/projects/guardon/guardon-self-assessment.md b/community/assessments/projects/guardon/guardon-self-assessment.md index 72f88562f..a4f386de4 100644 --- a/community/assessments/projects/guardon/guardon-self-assessment.md +++ b/community/assessments/projects/guardon/guardon-self-assessment.md @@ -33,7 +33,7 @@ Guardon is a **fully client-side browser extension** (Chrome/Edge/Brave) that pe Guardon shifts Kubernetes security **far left**, helping developers identify misconfigurations **before** they reach CI pipelines or clusters. -All validation happens locally inside the browser using **JavaScript + WebAssembly**. +All validation happens locally inside the browser using **JavaScript**. No backend, no cloud service, and **no user data ever leaves the machine**. --- @@ -46,7 +46,7 @@ Guardon has a strict and minimal security boundary: - No backend infrastructure - No telemetry or analytics - No transmission of YAML or policies to external systems -- Kyverno engine executes inside a local WebAssembly sandbox +- Instead, Guardon converts Kyverno policies to its own internal rule format for validation in the browser - No Kubernetes cluster access, no secrets, no tokens - Only interacts with user-selected YAML files or GitHub/GitLab DOM content @@ -54,7 +54,7 @@ Guardon has a strict and minimal security boundary: - Browser (Chrome/Brave/Edge) - Guardon WebExtension JS/TS code -- Embedded Kyverno-WASM engine +- Embedded Kyverno-rules engine - Local storage for rules and configuration --- @@ -79,29 +79,29 @@ Guardon has a strict and minimal security boundary: --- -## 4. System Architecture +## System Architecture -Guardon is composed of four main modules: +Guardon is built around four core modules: -1. **Content Script** - - Injected into GitHub/GitLab UI - - Extracts YAML sections from PR diffs or files - - Renders inline annotations +### **1. Content Script** +- Injected directly into GitHub/GitLab pages +- Extracts Kubernetes YAML from PRs, files, and diffs +- Displays inline annotations and highlights misconfigurations -2. **Worker Engine** - - Runs the Kyverno WASM policy evaluator - - Performs Kubernetes schema validation - - Executes custom rules from user-defined collections +### **2. Validation Engine** +- Parses YAML and performs schema validation using `js-yaml` +- Evaluates JSON-based custom rules and imported Kyverno policies +- Generates actionable, copy-paste-ready fix suggestions for every issue -3. **Background Service Worker** - - Handles cross-tab messaging - - Optional background fetch of referenced YAMLs - - Manages rule bundles +### **3. Background Service Worker** +- Manages cross-tab communication and extension lifecycle events +- Handles background tasks such as rule bundle loading and remote fetches +- Coordinates storage, caching, and sync of custom rules -4. **Extension UI** - - Popup for validation - - Options page for rule configuration - - Rule editor and custom bundles +### **4. Extension UI** +- Popup interface for instant YAML validation and fix previews +- Options page for rule import, export, and advanced customization +- Built-in rule editor for creating and managing custom rule bundles --- @@ -111,7 +111,7 @@ Guardon is composed of four main modules: - **Developer**: Uses Guardon while browsing YAML on GitHub/GitLab - **Browser**: Provides sandboxed execution environment - **Local Guardon Engine**: Performs validation -- **Kyverno-WASM**: Evaluates policies locally +- **Kyverno-JS**: Evaluates policies locally - **Rule Sources**: User-imported Kyverno rules stored locally ### **Data Flow Summary** @@ -130,7 +130,7 @@ Guardon is composed of four main modules: ### **Critical (Non-Configurable)** - Kubernetes schema validation -- Local Kyverno-WASM policy execution +- Local Kyverno-JS policy execution - Secure sandboxing of rule engine - YAML isolation and strict parsing - Immutable validation results @@ -176,13 +176,11 @@ Full threat model available in `guardon-threat-model.md`. - MIT License - CI pipeline with: - Static code analysis (ESLint) - - npm audit - - WASM linting + - npm audit - Automated dependency scanning - Reproducible build plan - Release bundles signed with GitHub provenance -- Mandatory code review for PRs -- Vulnerability reporting: security@guardon.dev +- Mandatory code review for PRs - SECURITY.md published in repository --- @@ -208,7 +206,6 @@ Guardon follows a **90-day disclosure window** or faster if required. ## 10. Known Limitations -- Depends on browser WASM performance - Limited by GitHub/GitLab DOM stability - Multi-GB YAML files not supported - Will not detect runtime or CVE-level vulnerabilities @@ -222,7 +219,6 @@ Guardon follows a **90-day disclosure window** or faster if required. - Signed rule packs - Rule provenance verification - In-extension SBOM viewer -- WASM sandbox hardening - AI-assisted policy recommendations - Support for JetBrains/VScode extensions - Organization-managed rule registries From 1687cd7601dcf71ff5ec696cbf586c41fbebc5b6 Mon Sep 17 00:00:00 2001 From: sajal-n <81651631+sajal-n@users.noreply.github.com> Date: Mon, 1 Dec 2025 00:00:02 -0500 Subject: [PATCH 11/27] Add system architecture section to self-assessment Signed-off-by: sajal-n <81651631+sajal-n@users.noreply.github.com> Signed-off-by: Sajal Nigam --- .../assessments/projects/guardon/guardon-self-assessment.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/community/assessments/projects/guardon/guardon-self-assessment.md b/community/assessments/projects/guardon/guardon-self-assessment.md index a4f386de4..0b8a6c1dd 100644 --- a/community/assessments/projects/guardon/guardon-self-assessment.md +++ b/community/assessments/projects/guardon/guardon-self-assessment.md @@ -81,6 +81,9 @@ Guardon has a strict and minimal security boundary: ## System Architecture +guardon-1 + + Guardon is built around four core modules: ### **1. Content Script** From 2617e8526a1d3fc1a9ee00d2ef8ca3abd6e83b9b Mon Sep 17 00:00:00 2001 From: sajal-n <81651631+sajal-n@users.noreply.github.com> Date: Mon, 1 Dec 2025 00:01:50 -0500 Subject: [PATCH 12/27] Replace system architecture image in guardon self-assessment Updated system architecture image in self-assessment document. Signed-off-by: sajal-n <81651631+sajal-n@users.noreply.github.com> Signed-off-by: Sajal Nigam --- .../assessments/projects/guardon/guardon-self-assessment.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/community/assessments/projects/guardon/guardon-self-assessment.md b/community/assessments/projects/guardon/guardon-self-assessment.md index 0b8a6c1dd..b44efa308 100644 --- a/community/assessments/projects/guardon/guardon-self-assessment.md +++ b/community/assessments/projects/guardon/guardon-self-assessment.md @@ -81,7 +81,7 @@ Guardon has a strict and minimal security boundary: ## System Architecture -guardon-1 +guardon-arch Guardon is built around four core modules: From 28f3ce0c5991006a73a3aa2c13b088b860261053 Mon Sep 17 00:00:00 2001 From: sajal-n <81651631+sajal-n@users.noreply.github.com> Date: Mon, 1 Dec 2025 00:05:26 -0500 Subject: [PATCH 13/27] Update threat model to reflect JS engine changes Signed-off-by: sajal-n <81651631+sajal-n@users.noreply.github.com> Signed-off-by: Sajal Nigam --- .../projects/guardon/guardon-threat-model.md | 22 ++++++------------- 1 file changed, 7 insertions(+), 15 deletions(-) diff --git a/community/assessments/projects/guardon/guardon-threat-model.md b/community/assessments/projects/guardon/guardon-threat-model.md index d34164091..ef20a273c 100644 --- a/community/assessments/projects/guardon/guardon-threat-model.md +++ b/community/assessments/projects/guardon/guardon-threat-model.md @@ -1,7 +1,7 @@ # Guardon — Threat Model (STRIDE-Based) **Methodology:** STRIDE -**Scope:** Browser extension + WASM policy engine + YAML parsing +**Scope:** Browser extension + JS policy engine + YAML parsing **Version:** v1.0 --- @@ -13,7 +13,7 @@ - Validation results - Local rule storage - Browser’s trust environment -- WASM engine integrity +- JS engine integrity - Guardon extension code --- @@ -23,7 +23,7 @@ ### **Primary** - Developer (authorized) - Guardon Extension -- Kyverno-WASM engine +- Kyverno-JS engine - Browser sandbox ### **Secondary** @@ -45,7 +45,7 @@ ### **S — Spoofing** **Risks:** - Impersonation of rule sources -- Malicious WASM module tampering +- Malicious JS module tampering - Fake extension versions **Mitigations:** @@ -64,8 +64,7 @@ **Mitigations:** - Local storage schema validation -- Immutable rule parsing -- Deterministic WASM behavior +- Immutable rule parsing - Content-Security-Policy enforcement --- @@ -112,15 +111,13 @@ ### **E — Elevation of Privilege** **Risks:** -- Extension gaining access to tokens -- WASM escaping sandbox +- Extension gaining access to tokens - DOM injection attacks escalating permissions **Mitigations:** - No access to cookies, tokens, or storage - Browser sandbox isolation -- Restricted extensions permissions (read-only) -- Strict WASM runtime boundaries +- Restricted extensions permissions (read-only) --- @@ -139,11 +136,6 @@ - Browser DOM - Local rule storage -- WebAssembly engine - YAML parser - Extension update mechanism ---- - -## 6. High-Level Data Flow Diagram (DFD) - From 2a98ad6c3ed95b8ce2641b1418d83941ddca0556 Mon Sep 17 00:00:00 2001 From: sajal-n <81651631+sajal-n@users.noreply.github.com> Date: Mon, 1 Dec 2025 00:10:00 -0500 Subject: [PATCH 14/27] Delete community/assessments/projects/guardon/metadata.yaml Signed-off-by: sajal-n <81651631+sajal-n@users.noreply.github.com> Signed-off-by: Sajal Nigam --- .../projects/guardon/metadata.yaml | 36 ------------------- 1 file changed, 36 deletions(-) delete mode 100644 community/assessments/projects/guardon/metadata.yaml diff --git a/community/assessments/projects/guardon/metadata.yaml b/community/assessments/projects/guardon/metadata.yaml deleted file mode 100644 index 0f1de7b91..000000000 --- a/community/assessments/projects/guardon/metadata.yaml +++ /dev/null @@ -1,36 +0,0 @@ -project: - name: Guardon - type: Browser Extension / Kubernetes Policy & YAML Validator - repo: "https://github.com/sajalkn/guardon" - maintainers: - - name: Sajal Nigam - email: sajalnigam@gmail.com - role: Lead Maintainer - -security: - contact: sajalnigam@gmail.com - policy: "https://github.com/sajalkn/guardon/security/policy" - incident_response: "https://github.com/sajalkn/guardon/docs/incident-response.md" - -assessment: - version: "v1.0" - date: "2025-XX-XX" - reviewers: [] - related_documents: - - guardon-self-assessment.md - - guardon-threat-model.md - -runtime: - environment: Browser WebExtension (Chrome/Edge/Brave) - executes_locally: true - uses_wasm: true - collects_telemetry: false - requires_backend: false - -boundaries: - inbound_data: - - Kubernetes YAML - - User-imported Kyverno rules - outbound_data: [] - network_access: false - cluster_access: false From bc1e0773b965518330a586790f9c64ce82472512 Mon Sep 17 00:00:00 2001 From: sajal-n <81651631+sajal-n@users.noreply.github.com> Date: Mon, 1 Dec 2025 00:12:10 -0500 Subject: [PATCH 15/27] Add self-assessment for Guardon project Added self-assessment documentation for Guardon project, detailing project overview, security boundaries, goals, architecture, and more. Signed-off-by: sajal-n <81651631+sajal-n@users.noreply.github.com> Signed-off-by: Sajal Nigam --- .../projects/guardon/self-assessment.md | 248 ++++++++++++++++++ 1 file changed, 248 insertions(+) create mode 100644 community/assessments/projects/guardon/self-assessment.md diff --git a/community/assessments/projects/guardon/self-assessment.md b/community/assessments/projects/guardon/self-assessment.md new file mode 100644 index 000000000..b44efa308 --- /dev/null +++ b/community/assessments/projects/guardon/self-assessment.md @@ -0,0 +1,248 @@ +# Guardon — CNCF TAG-Security Self-Assessment + +**Project:** Guardon +**Type:** Browser-based Kubernetes YAML & Policy Validator +**Website:** [Guardon](https://chromewebstore.google.com/detail/jhhegdmiakbocegfcfjngkodicpjkgpb?utm_source=item-share-cb) +**Contact:** sajalnigam@gmail.com +**Assessment Version:** v1.0 +**Last Updated:** 2025-11-28 + +--- + +## 1. Project Overview + +Guardon is a **fully client-side browser extension** (Chrome/Edge/Brave) that performs: + +- **Instant Kubernetes YAML validation** — Flags security misconfigurations as you browse GitHub/GitLab, with no CI/CD required. + +- **Schema-aware checks** — Validates manifests against uploaded Kubernetes OpenAPI/CRD schemas to ensure required fields and type safety. + +- **Customizable rule engine** — Supports JSON-based rules and Kyverno policy import for organization-specific governance standards. + +- **Multi-document YAML support** — Handles complex manifests containing multiple resources in a single file. + +- **Actionable fix suggestions** — Generates copy-paste-ready YAML patches for every violation. + +- **Dark mode UI** — Provides a seamless experience across day and night workflows. + +- **Offline-first** — All validation runs fully locally in your browser with zero network calls. + +- **Manual paste & validation** — Validate any YAML by pasting it directly into the extension popup, even outside GitHub/GitLab. + +- **Enterprise-ready** — Import/manage custom rules, preview Kyverno policies, and enforce governance at organizational scale. + + +Guardon shifts Kubernetes security **far left**, helping developers identify misconfigurations **before** they reach CI pipelines or clusters. +All validation happens locally inside the browser using **JavaScript**. +No backend, no cloud service, and **no user data ever leaves the machine**. + +--- + +## 2. Security Boundary + +Guardon has a strict and minimal security boundary: + +- Runs entirely within browser WebExtension APIs +- No backend infrastructure +- No telemetry or analytics +- No transmission of YAML or policies to external systems +- Instead, Guardon converts Kyverno policies to its own internal rule format for validation in the browser +- No Kubernetes cluster access, no secrets, no tokens +- Only interacts with user-selected YAML files or GitHub/GitLab DOM content + +**Trusted Computing Base (TCB):** + +- Browser (Chrome/Brave/Edge) +- Guardon WebExtension JS/TS code +- Embedded Kyverno-rules engine +- Local storage for rules and configuration + +--- + +## 3. Goals and Non-Goals + +### **Goals** +- Detect Kubernetes misconfigurations early, at authoring time +- Enforce governance standards using Kyverno rules +- Provide deterministic and reproducible validation results +- Work entirely offline and locally +- Improve developer productivity by embedding checks inside workflow +- Offer zero-trust handling of user data (no outbound calls) + +### **Non-Goals** +- Not a runtime security tool +- Not a replacement for PSP, PSA, Gatekeeper, or Kyverno in-cluster +- Not a network or API security solution +- Does not detect runtime attacks, malware, or CVEs +- Does not handle supply-chain validation outside YAML/policies +- Does not attest image provenance or signatures + +--- + +## System Architecture + +guardon-arch + + +Guardon is built around four core modules: + +### **1. Content Script** +- Injected directly into GitHub/GitLab pages +- Extracts Kubernetes YAML from PRs, files, and diffs +- Displays inline annotations and highlights misconfigurations + +### **2. Validation Engine** +- Parses YAML and performs schema validation using `js-yaml` +- Evaluates JSON-based custom rules and imported Kyverno policies +- Generates actionable, copy-paste-ready fix suggestions for every issue + +### **3. Background Service Worker** +- Manages cross-tab communication and extension lifecycle events +- Handles background tasks such as rule bundle loading and remote fetches +- Coordinates storage, caching, and sync of custom rules + +### **4. Extension UI** +- Popup interface for instant YAML validation and fix previews +- Options page for rule import, export, and advanced customization +- Built-in rule editor for creating and managing custom rule bundles + +--- + +## 5. Actors and Data Flow + +### **Actors** +- **Developer**: Uses Guardon while browsing YAML on GitHub/GitLab +- **Browser**: Provides sandboxed execution environment +- **Local Guardon Engine**: Performs validation +- **Kyverno-JS**: Evaluates policies locally +- **Rule Sources**: User-imported Kyverno rules stored locally + +### **Data Flow Summary** + +1. User views Kubernetes YAML on GitHub/GitLab +2. Guardon content script extracts YAML into memory +3. Data is sent to the Worker Engine (local only) +4. Worker evaluates schema + policies +5. Results returned to content script +6. Inline annotations displayed +7. No data is logged, stored externally, or transmitted + +--- + +## 6. Critical Security Functions + +### **Critical (Non-Configurable)** +- Kubernetes schema validation +- Local Kyverno-JS policy execution +- Secure sandboxing of rule engine +- YAML isolation and strict parsing +- Immutable validation results +- No-network guarantee +- No access to browser cookies, tokens, or secrets +- Extension CSP preventing inline script execution + +### **Security-Relevant (Configurable)** +- Custom rule bundle imports +- Background fetch helper for related YAMLs +- Organization-specific governance packs +- Optional CIS/NIST best-practice packages + +--- + +## 7. Threat Model (High-Level) + +### Guardon mitigates: +- Misconfigured workloads (privileged pods, hostPath, missing limits, etc.) +- RBAC over-permission +- Pod Security violations +- YAML structural errors +- Drift from organizational governance standards +- Incorrect multi-document YAML compositions +- Unsafe defaults (no resource limits, insecure capabilities) + +### Guardon does NOT mitigate: +- Runtime container escape +- Host/kernel compromise +- Image-level supply-chain attacks +- Network-level exploits +- Malicious browser extensions +- Insider threat or malicious developer intent +- Attacks on GitHub/GitLab itself + +Full threat model available in `guardon-threat-model.md`. + +--- + +## 8. Secure Development Practices + +- Public source code on GitHub +- MIT License +- CI pipeline with: + - Static code analysis (ESLint) + - npm audit +- Automated dependency scanning +- Reproducible build plan +- Release bundles signed with GitHub provenance +- Mandatory code review for PRs +- SECURITY.md published in repository + +--- + +## 9. Vulnerability Reporting & Incident Response + +**Contact:** sajalnigam@gmail.com +**Policy:** SECURITY.md follows TAG-Security template + +Incident handling workflow: + +1. Triage and reproduce issue +2. Assign CVSS score +3. Apply patch in a protected branch +4. Issue temporary private release for reporters if needed +5. Public security advisory via GitHub Security Advisories +6. Patch release with clear changelog +7. Update community channels + +Guardon follows a **90-day disclosure window** or faster if required. + +--- + +## 10. Known Limitations + +- Limited by GitHub/GitLab DOM stability +- Multi-GB YAML files not supported +- Will not detect runtime or CVE-level vulnerabilities +- No distributed policy cache (local only) +- Not compatible with Firefox yet (pending MV3 support) + +--- + +## 11. Roadmap (Security-Focused) + +- Signed rule packs +- Rule provenance verification +- In-extension SBOM viewer +- AI-assisted policy recommendations +- Support for JetBrains/VScode extensions +- Organization-managed rule registries +- Policy drift detection across repos + +--- + +## Appendix + +### Example Use Cases +- Detect privileged pod before code review +- Validate RBAC roles from GitHub UI +- Local evaluation of Kyverno policies before commits +- Quick governance compliance checks for microservices teams + +### Example Policies +- “Disallow hostPath” +- “Require resource limits/requests” +- “Block privileged containers” +- “Prevent hostNetwork usage” + +--- + +**End of Document** From ba4cedad8bfe48672d9768e6ddd1e3579aba05a5 Mon Sep 17 00:00:00 2001 From: sajal-n <81651631+sajal-n@users.noreply.github.com> Date: Mon, 1 Dec 2025 00:12:43 -0500 Subject: [PATCH 16/27] Delete community/assessments/projects/guardon/guardon-self-assessment.md Signed-off-by: sajal-n <81651631+sajal-n@users.noreply.github.com> Signed-off-by: Sajal Nigam --- .../guardon/guardon-self-assessment.md | 248 ------------------ 1 file changed, 248 deletions(-) delete mode 100644 community/assessments/projects/guardon/guardon-self-assessment.md diff --git a/community/assessments/projects/guardon/guardon-self-assessment.md b/community/assessments/projects/guardon/guardon-self-assessment.md deleted file mode 100644 index b44efa308..000000000 --- a/community/assessments/projects/guardon/guardon-self-assessment.md +++ /dev/null @@ -1,248 +0,0 @@ -# Guardon — CNCF TAG-Security Self-Assessment - -**Project:** Guardon -**Type:** Browser-based Kubernetes YAML & Policy Validator -**Website:** [Guardon](https://chromewebstore.google.com/detail/jhhegdmiakbocegfcfjngkodicpjkgpb?utm_source=item-share-cb) -**Contact:** sajalnigam@gmail.com -**Assessment Version:** v1.0 -**Last Updated:** 2025-11-28 - ---- - -## 1. Project Overview - -Guardon is a **fully client-side browser extension** (Chrome/Edge/Brave) that performs: - -- **Instant Kubernetes YAML validation** — Flags security misconfigurations as you browse GitHub/GitLab, with no CI/CD required. - -- **Schema-aware checks** — Validates manifests against uploaded Kubernetes OpenAPI/CRD schemas to ensure required fields and type safety. - -- **Customizable rule engine** — Supports JSON-based rules and Kyverno policy import for organization-specific governance standards. - -- **Multi-document YAML support** — Handles complex manifests containing multiple resources in a single file. - -- **Actionable fix suggestions** — Generates copy-paste-ready YAML patches for every violation. - -- **Dark mode UI** — Provides a seamless experience across day and night workflows. - -- **Offline-first** — All validation runs fully locally in your browser with zero network calls. - -- **Manual paste & validation** — Validate any YAML by pasting it directly into the extension popup, even outside GitHub/GitLab. - -- **Enterprise-ready** — Import/manage custom rules, preview Kyverno policies, and enforce governance at organizational scale. - - -Guardon shifts Kubernetes security **far left**, helping developers identify misconfigurations **before** they reach CI pipelines or clusters. -All validation happens locally inside the browser using **JavaScript**. -No backend, no cloud service, and **no user data ever leaves the machine**. - ---- - -## 2. Security Boundary - -Guardon has a strict and minimal security boundary: - -- Runs entirely within browser WebExtension APIs -- No backend infrastructure -- No telemetry or analytics -- No transmission of YAML or policies to external systems -- Instead, Guardon converts Kyverno policies to its own internal rule format for validation in the browser -- No Kubernetes cluster access, no secrets, no tokens -- Only interacts with user-selected YAML files or GitHub/GitLab DOM content - -**Trusted Computing Base (TCB):** - -- Browser (Chrome/Brave/Edge) -- Guardon WebExtension JS/TS code -- Embedded Kyverno-rules engine -- Local storage for rules and configuration - ---- - -## 3. Goals and Non-Goals - -### **Goals** -- Detect Kubernetes misconfigurations early, at authoring time -- Enforce governance standards using Kyverno rules -- Provide deterministic and reproducible validation results -- Work entirely offline and locally -- Improve developer productivity by embedding checks inside workflow -- Offer zero-trust handling of user data (no outbound calls) - -### **Non-Goals** -- Not a runtime security tool -- Not a replacement for PSP, PSA, Gatekeeper, or Kyverno in-cluster -- Not a network or API security solution -- Does not detect runtime attacks, malware, or CVEs -- Does not handle supply-chain validation outside YAML/policies -- Does not attest image provenance or signatures - ---- - -## System Architecture - -guardon-arch - - -Guardon is built around four core modules: - -### **1. Content Script** -- Injected directly into GitHub/GitLab pages -- Extracts Kubernetes YAML from PRs, files, and diffs -- Displays inline annotations and highlights misconfigurations - -### **2. Validation Engine** -- Parses YAML and performs schema validation using `js-yaml` -- Evaluates JSON-based custom rules and imported Kyverno policies -- Generates actionable, copy-paste-ready fix suggestions for every issue - -### **3. Background Service Worker** -- Manages cross-tab communication and extension lifecycle events -- Handles background tasks such as rule bundle loading and remote fetches -- Coordinates storage, caching, and sync of custom rules - -### **4. Extension UI** -- Popup interface for instant YAML validation and fix previews -- Options page for rule import, export, and advanced customization -- Built-in rule editor for creating and managing custom rule bundles - ---- - -## 5. Actors and Data Flow - -### **Actors** -- **Developer**: Uses Guardon while browsing YAML on GitHub/GitLab -- **Browser**: Provides sandboxed execution environment -- **Local Guardon Engine**: Performs validation -- **Kyverno-JS**: Evaluates policies locally -- **Rule Sources**: User-imported Kyverno rules stored locally - -### **Data Flow Summary** - -1. User views Kubernetes YAML on GitHub/GitLab -2. Guardon content script extracts YAML into memory -3. Data is sent to the Worker Engine (local only) -4. Worker evaluates schema + policies -5. Results returned to content script -6. Inline annotations displayed -7. No data is logged, stored externally, or transmitted - ---- - -## 6. Critical Security Functions - -### **Critical (Non-Configurable)** -- Kubernetes schema validation -- Local Kyverno-JS policy execution -- Secure sandboxing of rule engine -- YAML isolation and strict parsing -- Immutable validation results -- No-network guarantee -- No access to browser cookies, tokens, or secrets -- Extension CSP preventing inline script execution - -### **Security-Relevant (Configurable)** -- Custom rule bundle imports -- Background fetch helper for related YAMLs -- Organization-specific governance packs -- Optional CIS/NIST best-practice packages - ---- - -## 7. Threat Model (High-Level) - -### Guardon mitigates: -- Misconfigured workloads (privileged pods, hostPath, missing limits, etc.) -- RBAC over-permission -- Pod Security violations -- YAML structural errors -- Drift from organizational governance standards -- Incorrect multi-document YAML compositions -- Unsafe defaults (no resource limits, insecure capabilities) - -### Guardon does NOT mitigate: -- Runtime container escape -- Host/kernel compromise -- Image-level supply-chain attacks -- Network-level exploits -- Malicious browser extensions -- Insider threat or malicious developer intent -- Attacks on GitHub/GitLab itself - -Full threat model available in `guardon-threat-model.md`. - ---- - -## 8. Secure Development Practices - -- Public source code on GitHub -- MIT License -- CI pipeline with: - - Static code analysis (ESLint) - - npm audit -- Automated dependency scanning -- Reproducible build plan -- Release bundles signed with GitHub provenance -- Mandatory code review for PRs -- SECURITY.md published in repository - ---- - -## 9. Vulnerability Reporting & Incident Response - -**Contact:** sajalnigam@gmail.com -**Policy:** SECURITY.md follows TAG-Security template - -Incident handling workflow: - -1. Triage and reproduce issue -2. Assign CVSS score -3. Apply patch in a protected branch -4. Issue temporary private release for reporters if needed -5. Public security advisory via GitHub Security Advisories -6. Patch release with clear changelog -7. Update community channels - -Guardon follows a **90-day disclosure window** or faster if required. - ---- - -## 10. Known Limitations - -- Limited by GitHub/GitLab DOM stability -- Multi-GB YAML files not supported -- Will not detect runtime or CVE-level vulnerabilities -- No distributed policy cache (local only) -- Not compatible with Firefox yet (pending MV3 support) - ---- - -## 11. Roadmap (Security-Focused) - -- Signed rule packs -- Rule provenance verification -- In-extension SBOM viewer -- AI-assisted policy recommendations -- Support for JetBrains/VScode extensions -- Organization-managed rule registries -- Policy drift detection across repos - ---- - -## Appendix - -### Example Use Cases -- Detect privileged pod before code review -- Validate RBAC roles from GitHub UI -- Local evaluation of Kyverno policies before commits -- Quick governance compliance checks for microservices teams - -### Example Policies -- “Disallow hostPath” -- “Require resource limits/requests” -- “Block privileged containers” -- “Prevent hostNetwork usage” - ---- - -**End of Document** From 0c2bbd8a02bb35672208f8e6f3e15c6992592025 Mon Sep 17 00:00:00 2001 From: sajal-n <81651631+sajal-n@users.noreply.github.com> Date: Mon, 1 Dec 2025 00:13:59 -0500 Subject: [PATCH 17/27] Add STRIDE-based threat model for Guardon project Documented the threat model for the Guardon project using STRIDE methodology, detailing assets, actors, risks, mitigations, and attack surfaces. Signed-off-by: sajal-n <81651631+sajal-n@users.noreply.github.com> Signed-off-by: Sajal Nigam --- .../projects/guardon/threat-model.md | 141 ++++++++++++++++++ 1 file changed, 141 insertions(+) create mode 100644 community/assessments/projects/guardon/threat-model.md diff --git a/community/assessments/projects/guardon/threat-model.md b/community/assessments/projects/guardon/threat-model.md new file mode 100644 index 000000000..ef20a273c --- /dev/null +++ b/community/assessments/projects/guardon/threat-model.md @@ -0,0 +1,141 @@ +# Guardon — Threat Model (STRIDE-Based) + +**Methodology:** STRIDE +**Scope:** Browser extension + JS policy engine + YAML parsing +**Version:** v1.0 + +--- + +## 1. Assets + +- Kubernetes YAML documents +- User-defined policy bundles +- Validation results +- Local rule storage +- Browser’s trust environment +- JS engine integrity +- Guardon extension code + +--- + +## 2. Actors + +### **Primary** +- Developer (authorized) +- Guardon Extension +- Kyverno-JS engine +- Browser sandbox + +### **Secondary** +- GitHub/GitLab interface (untrusted but expected) +- External rule sources (trusted only through user import) + +### **Adversaries** +- Malicious developer +- Compromised browser extension ecosystem +- Supply-chain attacker +- Browser exploit attacker +- User with malicious intent +- Malicious JavaScript in GitHub/GitLab DOM + +--- + +## 3. STRIDE Analysis + +### **S — Spoofing** +**Risks:** +- Impersonation of rule sources +- Malicious JS module tampering +- Fake extension versions + +**Mitigations:** +- Signed releases +- No remote rule fetching +- CSP restricting script injection +- User-controlled rule import only + +--- + +### **T — Tampering** +**Risks:** +- Modification of rules in local storage +- DOM-based manipulation of annotations +- Altering validation logic via supply-chain JS + +**Mitigations:** +- Local storage schema validation +- Immutable rule parsing +- Content-Security-Policy enforcement + +--- + +### **R — Repudiation** +**Risks:** +- No server logs (intentional design) +- Hard to prove who changed rule bundles + +**Mitigations:** +- User confirmation flows for rule changes +- Optional local audit log (planned) +- Clearly documented local-only behavior + +--- + +### **I — Information Disclosure** +**Risks:** +- YAML content exposure if extension leaks +- Cross-tab data leakage +- Extension accessing unrelated browser data + +**Mitigations:** +- Strict MV3 permissions +- Zero telemetry design +- No cookie/storage access +- No external endpoints +- Runtime isolation via WASM + +--- + +### **D — Denial of Service** +**Risks:** +- Large YAML files freeze extension +- Malicious rule packs causing infinite evaluation +- DOM mutation overload from CI diffs + +**Mitigations:** +- Worker timeouts +- Rule execution limits +- Graceful fallback mode + +--- + +### **E — Elevation of Privilege** +**Risks:** +- Extension gaining access to tokens +- DOM injection attacks escalating permissions + +**Mitigations:** +- No access to cookies, tokens, or storage +- Browser sandbox isolation +- Restricted extensions permissions (read-only) + +--- + +## 4. Out-of-Scope Threats + +- Kubernetes runtime attacks +- Host/kernel exploitation +- Network/TLS attacks +- GitHub/GitLab authentication flows +- Supply-chain attacks unrelated to Guardon code +- Cross-extension interference + +--- + +## 5. Attack Surfaces + +- Browser DOM +- Local rule storage +- YAML parser +- Extension update mechanism + From 4bfb63326c15c6a2d0c086f76e17d01da72ca7dc Mon Sep 17 00:00:00 2001 From: sajal-n <81651631+sajal-n@users.noreply.github.com> Date: Mon, 1 Dec 2025 00:14:11 -0500 Subject: [PATCH 18/27] Delete community/assessments/projects/guardon/guardon-threat-model.md Signed-off-by: sajal-n <81651631+sajal-n@users.noreply.github.com> Signed-off-by: Sajal Nigam --- .../projects/guardon/guardon-threat-model.md | 141 ------------------ 1 file changed, 141 deletions(-) delete mode 100644 community/assessments/projects/guardon/guardon-threat-model.md diff --git a/community/assessments/projects/guardon/guardon-threat-model.md b/community/assessments/projects/guardon/guardon-threat-model.md deleted file mode 100644 index ef20a273c..000000000 --- a/community/assessments/projects/guardon/guardon-threat-model.md +++ /dev/null @@ -1,141 +0,0 @@ -# Guardon — Threat Model (STRIDE-Based) - -**Methodology:** STRIDE -**Scope:** Browser extension + JS policy engine + YAML parsing -**Version:** v1.0 - ---- - -## 1. Assets - -- Kubernetes YAML documents -- User-defined policy bundles -- Validation results -- Local rule storage -- Browser’s trust environment -- JS engine integrity -- Guardon extension code - ---- - -## 2. Actors - -### **Primary** -- Developer (authorized) -- Guardon Extension -- Kyverno-JS engine -- Browser sandbox - -### **Secondary** -- GitHub/GitLab interface (untrusted but expected) -- External rule sources (trusted only through user import) - -### **Adversaries** -- Malicious developer -- Compromised browser extension ecosystem -- Supply-chain attacker -- Browser exploit attacker -- User with malicious intent -- Malicious JavaScript in GitHub/GitLab DOM - ---- - -## 3. STRIDE Analysis - -### **S — Spoofing** -**Risks:** -- Impersonation of rule sources -- Malicious JS module tampering -- Fake extension versions - -**Mitigations:** -- Signed releases -- No remote rule fetching -- CSP restricting script injection -- User-controlled rule import only - ---- - -### **T — Tampering** -**Risks:** -- Modification of rules in local storage -- DOM-based manipulation of annotations -- Altering validation logic via supply-chain JS - -**Mitigations:** -- Local storage schema validation -- Immutable rule parsing -- Content-Security-Policy enforcement - ---- - -### **R — Repudiation** -**Risks:** -- No server logs (intentional design) -- Hard to prove who changed rule bundles - -**Mitigations:** -- User confirmation flows for rule changes -- Optional local audit log (planned) -- Clearly documented local-only behavior - ---- - -### **I — Information Disclosure** -**Risks:** -- YAML content exposure if extension leaks -- Cross-tab data leakage -- Extension accessing unrelated browser data - -**Mitigations:** -- Strict MV3 permissions -- Zero telemetry design -- No cookie/storage access -- No external endpoints -- Runtime isolation via WASM - ---- - -### **D — Denial of Service** -**Risks:** -- Large YAML files freeze extension -- Malicious rule packs causing infinite evaluation -- DOM mutation overload from CI diffs - -**Mitigations:** -- Worker timeouts -- Rule execution limits -- Graceful fallback mode - ---- - -### **E — Elevation of Privilege** -**Risks:** -- Extension gaining access to tokens -- DOM injection attacks escalating permissions - -**Mitigations:** -- No access to cookies, tokens, or storage -- Browser sandbox isolation -- Restricted extensions permissions (read-only) - ---- - -## 4. Out-of-Scope Threats - -- Kubernetes runtime attacks -- Host/kernel exploitation -- Network/TLS attacks -- GitHub/GitLab authentication flows -- Supply-chain attacks unrelated to Guardon code -- Cross-extension interference - ---- - -## 5. Attack Surfaces - -- Browser DOM -- Local rule storage -- YAML parser -- Extension update mechanism - From cfb25d1a0f4a8bde5d7b99ce655ea46b646786e3 Mon Sep 17 00:00:00 2001 From: Sajal Nigam Date: Mon, 1 Dec 2025 12:27:58 -0500 Subject: [PATCH 19/27] incorporating review comments Signed-off-by: Sajal Nigam --- community/assessments/projects/guardon/self-assessment.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/community/assessments/projects/guardon/self-assessment.md b/community/assessments/projects/guardon/self-assessment.md index b44efa308..d9558890d 100644 --- a/community/assessments/projects/guardon/self-assessment.md +++ b/community/assessments/projects/guardon/self-assessment.md @@ -181,7 +181,7 @@ Full threat model available in `guardon-threat-model.md`. - Static code analysis (ESLint) - npm audit - Automated dependency scanning -- Reproducible build plan +- Consistent and Auditable Build Process - Release bundles signed with GitHub provenance - Mandatory code review for PRs - SECURITY.md published in repository From 78ae9acf84c2d55b2ab96c8e7b6a34b2465feafc Mon Sep 17 00:00:00 2001 From: Sajal Nigam Date: Mon, 1 Dec 2025 22:59:47 -0500 Subject: [PATCH 20/27] fixed linting issue Signed-off-by: Sajal Nigam --- .../projects/guardon/self-assessment.md | 39 +++++++++++++------ .../projects/guardon/threat-model.md | 28 +++++++++++-- 2 files changed, 51 insertions(+), 16 deletions(-) diff --git a/community/assessments/projects/guardon/self-assessment.md b/community/assessments/projects/guardon/self-assessment.md index d9558890d..cd037cc7b 100644 --- a/community/assessments/projects/guardon/self-assessment.md +++ b/community/assessments/projects/guardon/self-assessment.md @@ -3,7 +3,7 @@ **Project:** Guardon **Type:** Browser-based Kubernetes YAML & Policy Validator **Website:** [Guardon](https://chromewebstore.google.com/detail/jhhegdmiakbocegfcfjngkodicpjkgpb?utm_source=item-share-cb) -**Contact:** sajalnigam@gmail.com +**Contact:** [sajalnigam@gmail.com](mailto:sajalnigam@gmail.com) **Assessment Version:** v1.0 **Last Updated:** 2025-11-28 @@ -31,8 +31,8 @@ Guardon is a **fully client-side browser extension** (Chrome/Edge/Brave) that pe - **Enterprise-ready** — Import/manage custom rules, preview Kyverno policies, and enforce governance at organizational scale. - -Guardon shifts Kubernetes security **far left**, helping developers identify misconfigurations **before** they reach CI pipelines or clusters. +Guardon shifts Kubernetes security **far left**, helping developers identify misconfigurations +**before** they reach CI pipelines or clusters. All validation happens locally inside the browser using **JavaScript**. No backend, no cloud service, and **no user data ever leaves the machine**. @@ -46,7 +46,7 @@ Guardon has a strict and minimal security boundary: - No backend infrastructure - No telemetry or analytics - No transmission of YAML or policies to external systems -- Instead, Guardon converts Kyverno policies to its own internal rule format for validation in the browser +- Instead, Guardon converts Kyverno policies to its own internal rule format for validation in the browser - No Kubernetes cluster access, no secrets, no tokens - Only interacts with user-selected YAML files or GitHub/GitLab DOM content @@ -62,6 +62,7 @@ Guardon has a strict and minimal security boundary: ## 3. Goals and Non-Goals ### **Goals** + - Detect Kubernetes misconfigurations early, at authoring time - Enforce governance standards using Kyverno rules - Provide deterministic and reproducible validation results @@ -70,6 +71,7 @@ Guardon has a strict and minimal security boundary: - Offer zero-trust handling of user data (no outbound calls) ### **Non-Goals** + - Not a runtime security tool - Not a replacement for PSP, PSA, Gatekeeper, or Kyverno in-cluster - Not a network or API security solution @@ -81,27 +83,30 @@ Guardon has a strict and minimal security boundary: ## System Architecture -guardon-arch - +![Guardon Architecture](https://github.com/user-attachments/assets/765d980f-2fad-412a-b6d5-07252a46c462) Guardon is built around four core modules: ### **1. Content Script** + - Injected directly into GitHub/GitLab pages - Extracts Kubernetes YAML from PRs, files, and diffs - Displays inline annotations and highlights misconfigurations ### **2. Validation Engine** + - Parses YAML and performs schema validation using `js-yaml` - Evaluates JSON-based custom rules and imported Kyverno policies - Generates actionable, copy-paste-ready fix suggestions for every issue ### **3. Background Service Worker** + - Manages cross-tab communication and extension lifecycle events - Handles background tasks such as rule bundle loading and remote fetches - Coordinates storage, caching, and sync of custom rules ### **4. Extension UI** + - Popup interface for instant YAML validation and fix previews - Options page for rule import, export, and advanced customization - Built-in rule editor for creating and managing custom rule bundles @@ -111,6 +116,7 @@ Guardon is built around four core modules: ## 5. Actors and Data Flow ### **Actors** + - **Developer**: Uses Guardon while browsing YAML on GitHub/GitLab - **Browser**: Provides sandboxed execution environment - **Local Guardon Engine**: Performs validation @@ -132,6 +138,7 @@ Guardon is built around four core modules: ## 6. Critical Security Functions ### **Critical (Non-Configurable)** + - Kubernetes schema validation - Local Kyverno-JS policy execution - Secure sandboxing of rule engine @@ -140,8 +147,10 @@ Guardon is built around four core modules: - No-network guarantee - No access to browser cookies, tokens, or secrets - Extension CSP preventing inline script execution +- Architecture and policies minimize dependency risk, but ongoing vigilance is required ### **Security-Relevant (Configurable)** + - Custom rule bundle imports - Background fetch helper for related YAMLs - Organization-specific governance packs @@ -151,7 +160,8 @@ Guardon is built around four core modules: ## 7. Threat Model (High-Level) -### Guardon mitigates: +### Guardon mitigates + - Misconfigured workloads (privileged pods, hostPath, missing limits, etc.) - RBAC over-permission - Pod Security violations @@ -160,7 +170,8 @@ Guardon is built around four core modules: - Incorrect multi-document YAML compositions - Unsafe defaults (no resource limits, insecure capabilities) -### Guardon does NOT mitigate: +### Guardon does NOT mitigate + - Runtime container escape - Host/kernel compromise - Image-level supply-chain attacks @@ -179,18 +190,19 @@ Full threat model available in `guardon-threat-model.md`. - MIT License - CI pipeline with: - Static code analysis (ESLint) - - npm audit + - npm audit - Automated dependency scanning - Consistent and Auditable Build Process - Release bundles signed with GitHub provenance -- Mandatory code review for PRs +- Mandatory code review for PRs - SECURITY.md published in repository +- Obtaining a OpenSSF badge is also on the roadmap --- ## 9. Vulnerability Reporting & Incident Response -**Contact:** sajalnigam@gmail.com +**Contact:** [sajalnigam@gmail.com](mailto:sajalnigam@gmail.com) **Policy:** SECURITY.md follows TAG-Security template Incident handling workflow: @@ -203,6 +215,7 @@ Incident handling workflow: 6. Patch release with clear changelog 7. Update community channels + Guardon follows a **90-day disclosure window** or faster if required. --- @@ -232,12 +245,14 @@ Guardon follows a **90-day disclosure window** or faster if required. ## Appendix ### Example Use Cases + - Detect privileged pod before code review - Validate RBAC roles from GitHub UI - Local evaluation of Kyverno policies before commits - Quick governance compliance checks for microservices teams ### Example Policies + - “Disallow hostPath” - “Require resource limits/requests” - “Block privileged containers” @@ -245,4 +260,4 @@ Guardon follows a **90-day disclosure window** or faster if required. --- -**End of Document** + diff --git a/community/assessments/projects/guardon/threat-model.md b/community/assessments/projects/guardon/threat-model.md index ef20a273c..82371f9e7 100644 --- a/community/assessments/projects/guardon/threat-model.md +++ b/community/assessments/projects/guardon/threat-model.md @@ -21,16 +21,19 @@ ## 2. Actors ### **Primary** + - Developer (authorized) - Guardon Extension - Kyverno-JS engine - Browser sandbox ### **Secondary** + - GitHub/GitLab interface (untrusted but expected) - External rule sources (trusted only through user import) ### **Adversaries** + - Malicious developer - Compromised browser extension ecosystem - Supply-chain attacker @@ -43,12 +46,15 @@ ## 3. STRIDE Analysis ### **S — Spoofing** + **Risks:** + - Impersonation of rule sources - Malicious JS module tampering - Fake extension versions **Mitigations:** + - Signed releases - No remote rule fetching - CSP restricting script injection @@ -57,24 +63,30 @@ --- ### **T — Tampering** + **Risks:** + - Modification of rules in local storage - DOM-based manipulation of annotations - Altering validation logic via supply-chain JS **Mitigations:** + - Local storage schema validation -- Immutable rule parsing +- Immutable rule parsing - Content-Security-Policy enforcement --- ### **R — Repudiation** + **Risks:** + - No server logs (intentional design) - Hard to prove who changed rule bundles **Mitigations:** + - User confirmation flows for rule changes - Optional local audit log (planned) - Clearly documented local-only behavior @@ -82,12 +94,15 @@ --- ### **I — Information Disclosure** + **Risks:** + - YAML content exposure if extension leaks - Cross-tab data leakage - Extension accessing unrelated browser data **Mitigations:** + - Strict MV3 permissions - Zero telemetry design - No cookie/storage access @@ -97,12 +112,15 @@ --- ### **D — Denial of Service** + **Risks:** + - Large YAML files freeze extension - Malicious rule packs causing infinite evaluation - DOM mutation overload from CI diffs **Mitigations:** + - Worker timeouts - Rule execution limits - Graceful fallback mode @@ -110,14 +128,17 @@ --- ### **E — Elevation of Privilege** + **Risks:** -- Extension gaining access to tokens + +- Extension gaining access to tokens - DOM injection attacks escalating permissions **Mitigations:** + - No access to cookies, tokens, or storage - Browser sandbox isolation -- Restricted extensions permissions (read-only) +- Restricted extensions permissions (read-only) --- @@ -138,4 +159,3 @@ - Local rule storage - YAML parser - Extension update mechanism - From 6c177788c0af113d4246f11dbbec17fbe6c2881d Mon Sep 17 00:00:00 2001 From: Sajal Nigam Date: Mon, 1 Dec 2025 23:06:25 -0500 Subject: [PATCH 21/27] fixed linting Signed-off-by: Sajal Nigam --- community/assessments/projects/guardon/self-assessment.md | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/community/assessments/projects/guardon/self-assessment.md b/community/assessments/projects/guardon/self-assessment.md index cd037cc7b..a1b6ffba4 100644 --- a/community/assessments/projects/guardon/self-assessment.md +++ b/community/assessments/projects/guardon/self-assessment.md @@ -215,7 +215,6 @@ Incident handling workflow: 6. Patch release with clear changelog 7. Update community channels - Guardon follows a **90-day disclosure window** or faster if required. --- @@ -258,6 +257,4 @@ Guardon follows a **90-day disclosure window** or faster if required. - “Block privileged containers” - “Prevent hostNetwork usage” ---- - - +--- \ No newline at end of file From 0b3c4e16642b967a78811e36c7e878822106bb4c Mon Sep 17 00:00:00 2001 From: Sajal Nigam Date: Mon, 1 Dec 2025 23:18:16 -0500 Subject: [PATCH 22/27] fixed remaining issues Signed-off-by: Sajal Nigam --- ci/spelling-config.json | 6 ++++- community/assessments/projects/guardon/DCO.md | 23 +++++++++++++++++++ .../projects/guardon/self-assessment.md | 2 -- 3 files changed, 28 insertions(+), 3 deletions(-) create mode 100644 community/assessments/projects/guardon/DCO.md diff --git a/ci/spelling-config.json b/ci/spelling-config.json index cabc2fda1..23e6994d3 100644 --- a/ci/spelling-config.json +++ b/ci/spelling-config.json @@ -235,6 +235,10 @@ "Aurélie", "Vache", "Kanabar", - "Michaely" + "Michaely", + "guardon", + "Guardon", + "guardon", + "Guardon" ] } diff --git a/community/assessments/projects/guardon/DCO.md b/community/assessments/projects/guardon/DCO.md new file mode 100644 index 000000000..d9db56bc2 --- /dev/null +++ b/community/assessments/projects/guardon/DCO.md @@ -0,0 +1,23 @@ +# Developer Certificate of Origin (DCO) + +By contributing to this project, you agree to the Developer Certificate of Origin: + +``` +Developer Certificate of Origin +Version 1.1 + +By making a contribution to this project, I certify that: + +1. The contribution was created in whole or in part by me and I have the right to submit it under the open source license indicated in the file; +2. The contribution is based upon previous work that, to the best of my knowledge, is covered under an appropriate open source license and I have the right under that license to submit that work with modifications, whether created in whole or in part by me, under the same open source license (unless I am permitted to submit under a different license), as indicated in the file; +3. The contribution was provided directly to me by some other person who certified (1), (2) or (3) and I have not modified it. +4. I understand and agree that this project and the contribution are public and that a record of the contribution (including all personal information I submit with it, including my sign-off) is maintained indefinitely and may be redistributed consistent with this project or the open source license(s) involved. +``` + +To sign off your commits, use the `--signoff` flag: + +``` +git commit --signoff +``` + +This will add a `Signed-off-by: Sajal Nigam ` line to your commit message, certifying your compliance with the DCO. \ No newline at end of file diff --git a/community/assessments/projects/guardon/self-assessment.md b/community/assessments/projects/guardon/self-assessment.md index a1b6ffba4..909c00ac3 100644 --- a/community/assessments/projects/guardon/self-assessment.md +++ b/community/assessments/projects/guardon/self-assessment.md @@ -256,5 +256,3 @@ Guardon follows a **90-day disclosure window** or faster if required. - “Require resource limits/requests” - “Block privileged containers” - “Prevent hostNetwork usage” - ---- \ No newline at end of file From f9ba0e7b159421d39930f8796247f6f76bf85f09 Mon Sep 17 00:00:00 2001 From: Sajal Nigam Date: Mon, 1 Dec 2025 23:24:34 -0500 Subject: [PATCH 23/27] fixed linting Signed-off-by: Sajal Nigam --- community/assessments/projects/guardon/DCO.md | 24 +++++++++++++------ 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/community/assessments/projects/guardon/DCO.md b/community/assessments/projects/guardon/DCO.md index d9db56bc2..11e09d866 100644 --- a/community/assessments/projects/guardon/DCO.md +++ b/community/assessments/projects/guardon/DCO.md @@ -2,22 +2,32 @@ By contributing to this project, you agree to the Developer Certificate of Origin: -``` +```text Developer Certificate of Origin Version 1.1 By making a contribution to this project, I certify that: -1. The contribution was created in whole or in part by me and I have the right to submit it under the open source license indicated in the file; -2. The contribution is based upon previous work that, to the best of my knowledge, is covered under an appropriate open source license and I have the right under that license to submit that work with modifications, whether created in whole or in part by me, under the same open source license (unless I am permitted to submit under a different license), as indicated in the file; -3. The contribution was provided directly to me by some other person who certified (1), (2) or (3) and I have not modified it. -4. I understand and agree that this project and the contribution are public and that a record of the contribution (including all personal information I submit with it, including my sign-off) is maintained indefinitely and may be redistributed consistent with this project or the open source license(s) involved. +1. The contribution was created in whole or in part by me and I have the right to + submit it under the open source license indicated in the file; +2. The contribution is based upon previous work that, to the best of my knowledge, + is covered under an appropriate open source license and I have the right under + that license to submit that work with modifications, whether created in whole + or in part by me, under the same open source license (unless I am permitted to + submit under a different license), as indicated in the file; +3. The contribution was provided directly to me by some other person who certified + (1), (2) or (3) and I have not modified it. +4. I understand and agree that this project and the contribution are public and that + a record of the contribution (including all personal information I submit with + it, including my sign-off) is maintained indefinitely and may be redistributed + consistent with this project or the open source license(s) involved. ``` To sign off your commits, use the `--signoff` flag: -``` +```sh git commit --signoff ``` -This will add a `Signed-off-by: Sajal Nigam ` line to your commit message, certifying your compliance with the DCO. \ No newline at end of file +This will add a `Signed-off-by: Sajal Nigam ` line to your +commit message, certifying your compliance with the DCO. From fa4bbc288b7ff78796ecce4a2fca77a7d6688721 Mon Sep 17 00:00:00 2001 From: Sajal Nigam Date: Mon, 1 Dec 2025 23:30:54 -0500 Subject: [PATCH 24/27] added my name to speling check ignore list Signed-off-by: Sajal Nigam --- ci/spelling-config.json | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ci/spelling-config.json b/ci/spelling-config.json index 23e6994d3..b7c632c5d 100644 --- a/ci/spelling-config.json +++ b/ci/spelling-config.json @@ -238,6 +238,9 @@ "Michaely", "guardon", "Guardon", + "Sajal", + "Nigam", + "Sajal Nigam" "guardon", "Guardon" ] From a36f731dd7b7aaabc1cac3f4204244d8aeead531 Mon Sep 17 00:00:00 2001 From: Sajal Nigam Date: Mon, 1 Dec 2025 23:34:15 -0500 Subject: [PATCH 25/27] fixed error Signed-off-by: Sajal Nigam --- ci/spelling-config.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ci/spelling-config.json b/ci/spelling-config.json index b7c632c5d..b23a27f69 100644 --- a/ci/spelling-config.json +++ b/ci/spelling-config.json @@ -240,7 +240,7 @@ "Guardon", "Sajal", "Nigam", - "Sajal Nigam" + "Sajal Nigam", "guardon", "Guardon" ] From 3c1d5052c3773f01d255ff485b54ef6eee134ab8 Mon Sep 17 00:00:00 2001 From: Sajal Nigam Date: Tue, 2 Dec 2025 11:39:18 -0500 Subject: [PATCH 26/27] minor correction Signed-off-by: Sajal Nigam --- community/assessments/projects/guardon/self-assessment.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/community/assessments/projects/guardon/self-assessment.md b/community/assessments/projects/guardon/self-assessment.md index 909c00ac3..2133c2088 100644 --- a/community/assessments/projects/guardon/self-assessment.md +++ b/community/assessments/projects/guardon/self-assessment.md @@ -237,7 +237,7 @@ Guardon follows a **90-day disclosure window** or faster if required. - AI-assisted policy recommendations - Support for JetBrains/VScode extensions - Organization-managed rule registries -- Policy drift detection across repos +- Policy drift detection across repository --- From 810513833bf1974278809a33ce693ee2b1784519 Mon Sep 17 00:00:00 2001 From: Sajal Nigam Date: Mon, 1 Dec 2025 22:59:47 -0500 Subject: [PATCH 27/27] minor correction Signed-off-by: Sajal Nigam --- community/assessments/projects/guardon/self-assessment.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/community/assessments/projects/guardon/self-assessment.md b/community/assessments/projects/guardon/self-assessment.md index 2133c2088..051d45e5d 100644 --- a/community/assessments/projects/guardon/self-assessment.md +++ b/community/assessments/projects/guardon/self-assessment.md @@ -237,7 +237,7 @@ Guardon follows a **90-day disclosure window** or faster if required. - AI-assisted policy recommendations - Support for JetBrains/VScode extensions - Organization-managed rule registries -- Policy drift detection across repository +- Policy drift detection across repo ---