Security
The security reference
Reviewers and accreditors read artifacts, not homepages. This page is one: the vulnerability-disclosure program, the audit-record architecture, dependency hygiene, and the gaps not yet closed — published, not implied.
Vulnerability disclosure
Marque is covered by Knitli's organization-level security policy. The preferred channel is GitHub Private Vulnerability Reporting on the source repository; encrypted email to security@knitli.com is the alternative. Good-faith research is authorized within the policy's stated CFAA and DMCA Section 1201 safe-harbor scope. Knitli acknowledges reports within 24 hours and begins triage within 5 business days. Coordinated disclosure follows ISO/IEC 29147: the default is 90 days from report, or after a fix has had reasonable deployment time, whichever is later, and no later than 120 days absent written agreement. Knitli requests CVEs for security-relevant findings; assignment is outside Knitli's control. There is no paid bounty at present, and credit or anonymity is the reporter's choice.
Content handling & audit records
Marque's machine-readable audit stream records applied fixes and qualifying terminal withholding decisions from the fix path; it is not an every-run receipt. Applied-fix records identify the rule and change. Withholding records identify the finding and why no change was applied. Raw or free-form document subject matter is excluded from the typed audit output.
Dependency hygiene
Dependency-relevant changes trigger cargo-deny checks against the workspace's configured license, ban, and source policies.
Dependency-relevant changes trigger cargo-audit against RustSec advisories for the committed Cargo.lock.
Dependency-relevant changes trigger cargo-vet against the configured audit policy. A separate cargo-deny policy checks the defined WASM-safe dependency subgraph.
Release integrity
The manually dispatched release workflow is configured to create a source archive plus workspace-level SPDX and merged CycloneDX software bills of materials. A non-dry-run release cut is configured to attest those artifacts. The workflow definition proves that the process is specified; it does not, by itself, prove that a release completed or that a particular artifact was produced.
Known gaps
| Gap | Status |
|---|---|
| Network-service authentication and abuse controls | The Marque server does not currently provide authentication or rate limiting. A deployment proxy must supply authentication, authorization, trusted-proxy handling, transport security, and abuse controls. |
| Access and event telemetry | Planned. There is no maintained authenticated request-event catalog, stable OpenTelemetry export contract, or reference SIEM path. The audit stream is not an access log. |
| Hardened reference deployment | Partial. A CLI-focused Gramine profile exists; hardened container and Kubernetes reference deployments remain planned. Network isolation and enclave operation depend on the deployment profile. |
| Completed release-artifact evidence | The archive, SBOM, and attestation workflow is specified, but a successful end-to-end non-dry-run release and its produced artifacts must be verified before claiming that outcome for a release. |
| Independent third-party assessment | None to date. No 3PAO or equivalent independent assessor has reviewed Marque. |
Posture
Knitli's Security & Transparency Framework is an internal engineering standard distilled from an evaluation of FedRAMP 20x Medium requirements, with certification-specific obligations removed or adapted. It is not a FedRAMP control baseline, KSI-satisfaction claim, authorization package, certification, or compliance claim. Marque operates inside the customer's deployment and authorization boundary; product, operator, and shared responsibilities remain distinct.