Security Policy

Scope

SPECIMEN is a defensive analysis tool for lab use only. It never executes, loads or unpacks samples: it reads their bytes and replays behaviour that a sandbox or an event log recorded elsewhere (CAPE/Cuckoo reports, Sysmon exports, native traces).

Supported versions

Security fixes go into the latest release on the main branch.

Reporting a vulnerability

Use GitHub's private vulnerability reporting: https://github.com/rakshit-737/specimen-malware-analysis/security/advisories/new. Do not open a public issue for a vulnerability, and do not attach live malware: send a hash and a description instead.

Relevant classes of issues include parser crashes or resource exhaustion on hostile reports, rule or Markdown injection through report strings, evidence-binding bypasses (a trace accepted for the wrong sample), and anything that would make SPECIMEN execute or fetch sample content.

Handling rules for contributors

• Never commit real malware, packed samples or password-protected archives. .gitignore blocks common formats.
• Test fixtures must stay inert. They are generated by specimen/lab_fixtures.py or are trimmed sandbox reports, and contain no executable code.
• Any future detonation code must default to fail-closed: if network isolation is not verified, it must not run.
• Auto-generated YARA and Sigma rules are experimental and must not be deployed without review.