vulnerability-disclosure.test.ts

import { describe, expect, test } from "bun:test";
import { readFileSync } from "node:fs";
import path from "node:path";

/**
 * The real verifier for control 0.5 in docs/SECURITY.md: "A published reporting channel with a
 * stated response time." Before this test existed, 0.5's "Verified by" column linked SECURITY.md
 * to itself - a claim is not evidence for itself, and security-check.mjs's drift guard could not
 * tell the difference because it never required a "Verified by" link to be a test.
 *
 * This reads the actual root SECURITY.md (the disclosure policy; docs/SECURITY.md is the
 * inventory that links here) and fails the moment the reporting channel or its response-time
 * commitment is removed or reworded past recognition.
 */
const POLICY = readFileSync(path.resolve(import.meta.dir, "../../SECURITY.md"), "utf8");

describe("the published vulnerability disclosure channel (docs/SECURITY.md control 0.5)", () => {
  test("names an email address to report a vulnerability to", () => {
    expect(POLICY).toMatch(/\*\*Email:\*\*\s*[^\s@]+@[^\s@]+\.[^\s@]+/);
  });

  test("states a response time for the initial acknowledgment", () => {
    expect(POLICY).toMatch(/acknowledge receipt of your vulnerability report within \*\*\d+\s+hours\*\*/i);
  });

  test("tells a reporter where NOT to go, ahead of where to go", () => {
    // A public issue tracker is the wrong channel for a vulnerability; the policy has to say so
    // before it names the right one, or a reporter finds the wrong door first.
    expect(POLICY).toMatch(/do not report security vulnerabilities through public github issues/i);
  });
});