RFC-005: Automated CVE Security Check System

Rejection Reason

This RFC is rejected for the following reasons:

1. cargo audit is sufficient for the requirements

The Rust ecosystem already has a mature cargo audit tool that can:

• Automatically detect known CVEs in dependencies
• Check if dependencies are deprecated
• Integrate easily with CI/CD

There is no need to reinvent the wheel.

2. Resource investment does not proportional to benefits

Building a proprietary CVE scanning system requires:

• Continuously maintaining a vulnerability database
• Regularly updating detection rules
• Developing AI enhancement features (complex with uncertain results)

And cargo audit is already good enough.

---

Summary

This RFC proposes establishing an automated CVE (Common Vulnerabilities and Exposures) security check system based on AI Enhancement + GitHub Actions, which performs security scanning automatically at code commits, dependency changes, and release points, to detect and warn about potential security risks early.

Motivation

Why is this feature needed?

Security of open-source projects is increasingly important:

1. Dependency vulnerability risks: Third-party dependencies used by the project may contain known vulnerabilities
2. Supply chain attacks: Malicious code may be injected through dependency chains
3. Timely discovery: Vulnerabilities need to be quickly assessed and fixed after discovery
4. Compliance requirements: Enterprise users have compliance requirements for code security

Current Problems

The current project has the following security blind spots:

• Unknown dependencies: Cargo/Rust dependency versions and vulnerability status are not systematically tracked
• Manual checks: Dependency updates and security audits rely on manual inspection
• No CI integration: Security checks are not enforced in CI pipelines
• Missing alerts: Unable to promptly assess impact when new CVEs are published

Proposal

Core Architecture

┌─────────────────────────────────────────────────────────────┐
│                    Security Check Architecture              │
├─────────────────────────────────────────────────────────────┤
│                                                              │
│  ┌─────────────┐    ┌─────────────┐    ┌─────────────┐     │
│  │  Code Push  │    │  Dependency │    │  Scheduled  │     │
│  │             │    │   Change    │    │   Trigger   │     │
│  └──────┬──────┘    └──────┬──────┘    └──────┬──────┘     │
│         │                  │                  │             │
│         └──────────────────┼──────────────────┘             │
│                            │                                │
│                            ▼                                │
│              ┌─────────────────────────┐                    │
│              │     GitHub Actions      │                    │
│              │     Automated Workflow   │                    │
│              └───────────┬─────────────┘                    │
│                          │                                  │
│          ┌───────────────┼───────────────┐                  │
│          ▼               ▼               ▼                  │
│   ┌────────────┐  ┌────────────┐  ┌────────────┐           │
│   │Dependency  │  │   Code     │  │    AI      │           │
│   │Vuln Scan   │  │  Security  │  │  Risk      │           │
│   │(Cargo)     │  │  Analysis  │  │  Assessment│           │
│   │            │  │(Semgrep)   │  │  (LLM)     │           │
│   └────────────┘  └────────────┘  └────────────┘           │
│                          │                                  │
│                          ▼                                  │
│              ┌─────────────────────────┐                    │
│              │  Vulnerability DB + AI  │                    │
│              │  (NVD + GitHub Advisories│                    │
│              │   + Custom Rules)       │                    │
│              └───────────┬─────────────┘                    │
│                          │                                  │
│                          ▼                                  │
│              ┌─────────────────────────┐                    │
│              │   Security Report +      │                    │
│              │   Alert Notifications    │                    │
│              └─────────────────────────┘                    │
│                                                              │
└─────────────────────────────────────────────────────────────┘

Technology Selection

Component	Technology Solution	Description
Dependency Scan	cargo-audit	Rust official vulnerability DB
Code Security	Semgrep	Static analysis with custom rules
AI Risk Assessment	OpenAI API / Claude API	Vulnerability impact & fixes
Vulnerability DB	NVD + GitHub Advisory DB	Official vulnerability sources
Workflow Orchestration	GitHub Actions	Native integration, no extra infra

GitHub Actions Workflow Design

1. On-push Check (security-check.yml)

# .github/workflows/security-check.yml
name: Security Check

on:
  push:
    branches: [main, develop]
    paths:
      - '**/Cargo.toml'
      - '**/Cargo.lock'
      - 'src/**'
      - 'rust-toolchain*'
  pull_request:
    paths:
      - '**/Cargo.toml'
      - '**/Cargo.lock'
      - 'src/**'

jobs:
  dependency-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable

      - name: Cache dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            target/
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-

      - name: Run cargo-audit
        uses: actions-rs/audit-check@v1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
        continue-on-error: true

      - name: AI Vulnerability Analysis
        if: failure()
        run: |
          echo "Running AI analysis..."
          # Call AI to analyze vulnerability impact
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

  code-security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run Semgrep
        uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            r/security-audit r/lang-rust
        continue-on-error: true

  generate-report:
    needs: [dependency-audit, code-security]
    runs-on: ubuntu-latest
    if: always()
    steps:
      - name: Generate Security Report
        run: |
          echo "## Security Check Report" >> $GITHUB_STEP_SUMMARY
          # Generate Markdown format report

2. Scheduled Full Scan (security-scheduled.yml)

# .github/workflows/security-scheduled.yml
name: Scheduled Security Scan

on:
  schedule:
    # Run daily at midnight UTC
    - cron: '0 0 * * *'
  # Manual trigger
  workflow_dispatch:
    inputs:
      scan_level:
        description: 'Scan Level'
        required: false
        default: 'full'
        type: choice
        options:
          - full
          - dependencies
          - code

jobs:
  daily-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Full Dependency Audit
        run: |
          cargo audit --json > audit_results.json
          # Process JSON results

      - name: Check for Yanked Versions
        run: |
          # Check if there are yanked versions in Cargo.toml
          cargo update --dry-run | grep yanked

      - name: AI Security Assessment
        run: |
          # AI analyzes new vulnerability risks
          python3 ai_security_analysis.py
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

      - name: Send Notification
        if: failure()
        uses: slackapi/slack-github-action@v1
        with:
          payload: |
            {
              "text": "🚨 YaoXiang Security Scan Found New Vulnerabilities",
              "attachments": [...]
            }

AI Enhancement Features

Vulnerability Impact Analysis

# ai_vulnerability_analysis.py

import openai
import json

def analyze_vulnerability(vulnerability_data: dict) -> dict:
    """
    Use AI to analyze vulnerability impact scope and fix priority
    """

    prompt = f"""
    Analyze the following security vulnerability information and provide fix recommendations:

    Vulnerability Details:
    - CVE ID: {vulnerability_data['cve_id']}
    - Package Name: {vulnerability_data['package']}
    - Affected Versions: {vulnerability_data['affected_versions']}
    - Severity: {vulnerability_data['severity']}
    - Description: {vulnerability_data['description']}

    Project Information:
    - Current Version: {vulnerability_data['current_version']}
    - Is in Critical Path: {vulnerability_data['is_critical_path']}

    Please provide:
    1. Impact Assessment (1-10 score)
    2. Fix Priority (P0/P1/P2/P3)
    3. Recommended fix steps
    4. Temporary mitigation measures
    """

    response = openai.ChatCompletion.create(
        model="gpt-4",
        messages=[
            {
                "role": "system",
                "content": "You are a code security expert, specializing in open source project vulnerability analysis and fix recommendations."
            },
            {"role": "user", "content": prompt}
        ],
        temperature=0.3
    )

    return parse_ai_response(response)

Custom Security Rules

# .semgrep/rules/security-audit.yaml

rules:
  - id: yaoxiang-unsafe-ffi
    pattern: |
      extern "C" {
        $FUNC(...)
      }
    message: |
      FFI call detected, please ensure:
      1. Parameters are properly validated
      2. Memory is properly freed
      3. Errors are properly handled
    severity: WARNING
    languages: [rust]

  - id: yaoxiang-dos-risk
    pattern: |
      fn $FUNC(...) {
        ...
        $VAR.clone()
        ...
      }
    message: |
      Potential DoS risk: Be careful with clone operations on large objects
    severity: WARNING
    languages: [rust]

Security Report Format

# YaoXiang Security Scan Report

**Scan Time**: 2025-01-05 10:30:00 UTC **Scan Branch**: main **Commit Hash**: abc123def456

## Vulnerability Summary

| Severity | Count | Status     |
| -------- | ----- | ---------- |
| Critical | 0     | None       |
| High     | 2     | Pending    |
| Medium   | 5     | Assessed   |
| Low      | 12    | Monitoring |

## Dependency Vulnerabilities

### High - Requires Immediate Action

1. **CVE-2024-XXXXX: package-name**
   - Affected Versions: < 1.2.0
   - Current Version: 1.1.5 (Vulnerable)
   - Fixed Version: 1.2.0
   - AI Risk Assessment: P0 - High Risk

### Medium - Handle This Week

...

## Code Security Issues

...

## AI Analysis Summary

This scan found 2 high-risk vulnerabilities, priority should be given to...

## Recommended Actions

- [ ] Upgrade `package-name` to 1.2.0
- [ ] Review FFI calls in `module/path/file.rs`
- [ ] Configure Dependabot for automatic dependency updates

Detailed Design

Integration Points

Stage	Integration Point	Check Content	Blocking Condition
On-push	PR CI	Dependency vuln, code issues	Critical/High
On-merge	Merge Check	Full security scan	Critical/High
On-release	Release CI	Comprehensive security audit	Any vulnerability
Scheduled	Daily Job	New CVE check, dep updates	Notification

Permission Model

permissions:
  contents: read
  security-events: write
  checks: write
  issues: write # Used to create security alert issues

Notification Strategy

Event	Notification Method	Recipients
Critical/High Vuln	Slack + Email + GitHub Mention	Security team + PR author
Medium Vulnerability	GitHub Issue	Code owners
Daily Summary	Email	All contributors
Fix Completed	GitHub Check	PR participants

Trade-offs

Advantages

• High automation: No manual intervention, automatic scanning and reporting
• AI enhancement: Intelligent analysis of vulnerability impact, reduces false positives
• Multi-layer protection: Dependency, code, and supply chain coverage
• CI/CD integration: Security checks integrated into development workflow
• Extensible: Supports custom rules and AI models

Disadvantages

• External service dependency: AI analysis requires OpenAI/Claude API
• Cost considerations: Large-scale scanning may incur API call fees
• False positive handling: Rules need continuous optimization to reduce false positives
• Maintenance cost: Rule database requires continuous updates

Alternative Solutions

Solution	Description	Why Not Chosen
Only cargo-audit	Dependency vulnerability scan only	Lacks code-level security analysis
Commercial security	Use Snyk, Sonatype, etc.	High cost, poor customization
Manual audit only	Manual code and dependency check	Inefficient, limited coverage
Semgrep only	Code static analysis only	Lacks dependency vulnerability data

Implementation Strategy

Phase Division

1. Phase 1: Basic Dependency Scan (v0.3)

   • Configure cargo-audit GitHub Action
   • Establish security report template
   • Add basic Slack/email notifications

2. Phase 2: Code Security Analysis (v0.4)

   • Configure Semgrep ruleset
   • Add custom security rules
   • Establish vulnerability triage process

3. Phase 3: AI Enhancement (v0.5)

   • Integrate OpenAI/Claude API
   • Implement vulnerability impact analysis
   • Develop fix recommendation generation

4. Phase 4: Advanced Features (v0.6)

   • Automatic fix PRs
   • Supply chain security signing
   • Bug bounty integration

Dependencies

• Phase 1 → Phase 2 → Phase 3 → Phase 4 (sequential dependency)
• No external RFC dependencies

Risks

Risk	Impact	Mitigation
API key leak	Security	Use GitHub Secrets, rotate regularly
Scan timeout	CI delay	Set timeout limits, optimize scope
Too many false positives	Dev frustration	Continuously optimize rules, establish whitelist
Cost overrun	Financial	Set API call limits, use caching

Open Questions

• [ ] Which AI service provider to use? (OpenAI / Anthropic / Local deployment)
• [ ] Should automatic fix PRs be created?
• [ ] How to handle supply chain attack detection?
• [ ] Should private dependency repositories be supported?

---

Appendix

Appendix A: Security Scan Configuration

# cargo-audit configuration
# cargo.toml or .cargo/config.toml

[package.metadata.audit]
# Ignore specific vulnerabilities
ignore = ["RUSTSEC-0000-0000"]

# Severity threshold
severity-threshold = "medium"

# Allowed licenses
allow = ["MIT", "Apache-2.0", "BSD-3-Clause"]

Appendix B: GitHub Security Advisory Configuration

# .github/advisories.yml
# Custom vulnerability database

exceptions:
  - package: 'some-internal-crate'
    vulnerability: 'YX-2024-001'
    reason: 'Internal use only, mitigation measures in place'
    expires: '2025-06-01'

Appendix C: Glossary

Term	Definition
CVE	Common Vulnerabilities and Exposures
CVSS	Common Vulnerability Scoring System
NVD	National Vulnerability Database
SAST	Static Application Security Testing
SCA	Software Composition Analysis

---

References

• GitHub Advisory Database
• cargo-audit
• Semgrep
• OWASP Top 10