RustFS Security Advisory Lessons
Use this skill as the deep security lens. For a normal adversarial review with a
matched security surface, the concise security reference under
adversarial-validation is sufficient.
Workflow
- Freeze the exact diff/head and identify the changed trust boundaries.
- Inspect the headings in advisory-patterns.md,
then read the matching sections. Read the full map only for a broad security
audit. Useful headings are
auth/admin, IAM/STS/OIDC, policy/plugins, S3/copy/multipart, protocols, paths,
secrets/logging/RPC, browser/CORS/proxy, SSE, Object Lock, and serde.
- Trace unauthenticated, low-privilege, wrong-action/owner/bucket, malformed,
and default-config cases. Security decisions must fail closed.
- Require a focused negative regression test for the bypass/exploit form, not
only the intended success path. State residual risk when a test is impractical.
- Report proven vulnerabilities separately from defense-in-depth hardening.
When advisory currentness matters, fetch the live inventory instead of treating
the reference as a status mirror:
gh api repos/rustfs/rustfs/security-advisories --paginate \
--jq '.[] | {ghsa_id,state,severity,summary,updated_at}'
Fetch an individual advisory only when the live summary indicates a new or
changed lesson.
Finding Standard
Each finding includes severity, file:line, attacker prerequisites, concrete
input/path, impact, smallest safe fix, and a regression check. Do not exaggerate
unauthenticated impact when the actual issue requires authenticated low privilege.
1---2name: security-advisory-lessons3description: Perform a dedicated RustFS security/advisory review for authn/authz, IAM, RPC trust, paths, secrets, browser isolation, encryption, Object Lock, or other security boundaries. Use only when the user requests a security/advisory review or an adversarial review explicitly escalates to the full advisory map; do not auto-load solely because code touches a sensitive path.4---56# RustFS Security Advisory Lessons78Use this skill as the deep security lens. For a normal adversarial review with a9matched security surface, the concise security reference under10`adversarial-validation` is sufficient.1112## Workflow13141. Freeze the exact diff/head and identify the changed trust boundaries.152. Inspect the headings in [advisory-patterns.md](references/advisory-patterns.md),16 then read the matching sections. Read the full map only for a broad security17 audit. Useful headings are18 auth/admin, IAM/STS/OIDC, policy/plugins, S3/copy/multipart, protocols, paths,19 secrets/logging/RPC, browser/CORS/proxy, SSE, Object Lock, and serde.203. Trace unauthenticated, low-privilege, wrong-action/owner/bucket, malformed,21 and default-config cases. Security decisions must fail closed.224. Require a focused negative regression test for the bypass/exploit form, not23 only the intended success path. State residual risk when a test is impractical.245. Report proven vulnerabilities separately from defense-in-depth hardening.2526When advisory currentness matters, fetch the live inventory instead of treating27the reference as a status mirror:2829```bash30gh api repos/rustfs/rustfs/security-advisories --paginate \31 --jq '.[] | {ghsa_id,state,severity,summary,updated_at}'32```3334Fetch an individual advisory only when the live summary indicates a new or35changed lesson.3637## Finding Standard3839Each finding includes severity, `file:line`, attacker prerequisites, concrete40input/path, impact, smallest safe fix, and a regression check. Do not exaggerate41unauthenticated impact when the actual issue requires authenticated low privilege.
rustfs