open/llm-security
1
0
Fork 0
Code Issues Releases 6 Activity

fix(posture): NIST Govern credit for policy.json only when it is honored

Browse source 
checkNISTAlignment credited Govern for a .llm-security/policy.json that
merely existed. Since v8.1.0 policy-loader ignores a target's policy
outside the caller's own working tree, so a foreign target (a clone, an
installed package) earned governance credit for a file no scanner reads.
The credit now also requires isOwnWorkingTree(projectRoot).

Red first: the two foreign cases (node_modules package, target outside
cwd) failed; the own-tree known-positive passed before and after.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Kjell Tore Guttormsen 2026-09-22 21:32:46 +02:00
commit 50f60b46e2
Signed by: ktg
SSH key fingerprint: SHA256:JakMjO6FTBBzN0Bhfj9saOoEjaFxlSdYuZQQpM/lF9Q
2 changed files with 77 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
scanners/posture-scanner.mjs
View file

@ -15,6 +15,7 @@ import { homedir } from 'node:os';
import { scanForInjection } from './lib/injection-patterns.mjs';
import { gradeFromPassRate, riskScore, riskBand, verdict, SEVERITY } from './lib/severity.mjs';
import { finding, scannerResult, resetCounter } from './lib/output.mjs';
import { isOwnWorkingTree } from './lib/own-working-tree.mjs';
// ---------------------------------------------------------------------------
// Constants
@ -1331,7 +1332,10 @@ async function checkNISTAlignment(projectRoot, hooksJson, projectSettings) {
// Govern: deny-first configuration or policy documentation
const settingsJson = projectSettings || await readJson(join(projectRoot, '.claude', 'settings.json'));
const hasDenyFirst = settingsJson?.permissions?.defaultPermissionLevel === 'deny';
const hasPolicyFile = await fileExists(join(projectRoot, '.llm-security', 'policy.json'));
// v8.1.2: a policy.json counts only when it is honored for this target —
// policy-loader.mjs ignores it outside the caller's own working tree.
const hasPolicyFile = await fileExists(join(projectRoot, '.llm-security', 'policy.json'))
&& isOwnWorkingTree(projectRoot);
if (hasDenyFirst || hasPolicyFile) {
functionsPresent++;
evidence.push('Govern: deny-first config or policy file present');