llm-security/STATE.md

STATE — llm-security

👉 NESTE — START HER (fresh session, Opus 4.8 xhigh) — the MEDIUM sweep: v7.8.2 SHIPPED — all 5 HIGH from the completion review are fixed, released, tagged, catalog-synced and pushed. Next is the MEDIUM tier (52 findings) from the same review. Expect it to be its own release (v7.8.3 or v7.9.0), not a continuation of v7.8.2. Same discipline that worked this session: verify each finding against the code FIRST (STATE's own descriptions proved wrong 3x — see below), Iron Law per defect, one commit each. Triage first: 52 MEDIUMs will contain duplicates and non-defects — do a verification pass and report the real count before planning the release.

Review output (harvest source): confirmed array + per-finding adversarial reasoning in task w8s4rsaw8 output: …/dfcab047-5467-4484-ab1a-5d6526439f78/tasks/w8s4rsaw8.output (result.confirmed, 59 items). Durable journal: ~/.claude/projects/-Users-…-llm-security/ f99dcf73-d344-4377-b8ba-09fe878f32a2/subagents/workflows/wf_99daed37-f8b/journal.jsonl.

Lesson from v7.8.2 — the review's own text is a premiss, not a fact

Three of five findings were described inaccurately in STATE/the review. Verify before acting:

• Paths were wrong: hooks live in hooks/scripts/, the parser in scanners/lib/.
• Blast radius was understated (the rm-block also missed /*, -fr, and sudo-prefixed forms).
• Severity was overstated once: the char-ref defect does NOT break the no-throw contract (safe() catches it) and needs non-well-formed XML, so it is below HIGH. Said so in the commit.
• The old pre-bash-destructive.test.mjs had encoded the bug as expected behaviour with a wrong root-cause NOTE. Green suites can be green because the test was shaped around the defect — when a test comment explains why something isn't caught, treat it as a lead, not a spec.

⚠️ NEVER git add -A in this repo

Did it this session and swept the 3 parked docs into a release commit aimed at a PUBLIC mirror. Caught before push and amended out, but the guard is: stage explicit paths, always.

PARKED — v8 family strategy (behind an operator visibility decision, DO NOT PUSH)

4 of 6 deliverables written, LOCAL ONLY: docs/JOBS-TO-BE-DONE.md, docs/FAMILY-MAP.md, docs/commons-extraction-plan.md, docs/roadmap.md [gitignored]. Remaining v8 docs (do NOT start until visibility is decided): formal docs/completion-review-2026-07-17.md and V8-ANNOUNCEMENT.md. DO NOT PUSH the 3 untracked docs: origin open/llm-security.git is a PUBLIC mirror; they describe cross-repo strategy + a sibling (claude-code-llm-wiki, "Private pending Anthropic ToS"). NOTE: docs/FAMILY-MAP.md:42 says v7.8.0/1863 tests — stale, fix when the parking ends.

Ground truth (verified 2026-07-18)

• npm test = 1901/0 green at tip (1865 + 36 new). Run with npm test — node --test tests/ is NOT valid; the script is node --test 'tests/**/*.test.mjs'.
• v7.8.2 released: tag v7.8.2 pushed, catalog ref bumped, check-versions.mjs = 0 ERROR (the one WARN is okr, pre-existing and unrelated).
• Test-pollution trap (hit and fixed): jetbrains-parser.test.mjs asserts globally that no llmsec-jb-* dir survives in tmpdir. Any new test using that mkdtemp prefix fails it order-dependently — passed one full run, failed the next. Pick a non-colliding prefix.
• Exported for testability, do not "tidy" away: validateContent (auto-cleaner, v7.8.1), stripInjection (content-extractor, v7.8.2), scanOneExtension (ide-extension-scanner). content-extractor.mjs now runs main() behind an isMain guard — CLI re-verified working.
• Known residual gap (documented, not a bug to re-file): stripInjection cannot attribute a payload encoded ACROSS lines; those findings carry unstripped: true by design. Whole-file redaction was considered and rejected (normalizeForScan base64-decodes any long blob).
• Prior security: F-1/2/3/5/6 fixed; F-4 open (optional/LOW); B1/B2/E14 fixed.

Position taken (strategic anchor)

llm-security consolidates; growth at family level (security-commons + llm-retrieval-guard sibling for the LLM08 write→retrieval seam). JS/TS AST-taint parity + post-clone CLAUDE.md-poisoning stay here; research artifact-scanners (model/pickle, .ipynb, insecure-ML) relocate to commons/guard. v8.0.0 = deprecation cleanup (LLM_SECURITY_* env-vars + riskScoreV1) + behaviour-preserving commons extraction + verified fixes + docs consistency.

Continuity

origin = Forgejo open/llm-security (PUBLIC, never GitHub). Push window: weekdays 20:00–23:00; weekends/holidays anytime. STATE.md is intentionally TRACKED + committed (.gitignore:19-20 NOTE). Disclosure convention: a security fix to public code is committed but HELD until its release tag exists, so the exploit description never lands before the fixed version. Fix, bump, tag, catalog, push. Release mechanics: catalog/scripts/release-plugin.mjs <plugin> --version X.Y.Z (dry-run by default; --create-tag, then --write --commit --push). It refuses unless plugin.json == README badge == target. Push the plugin repo's commits BEFORE --create-tag.