nandi.uk
Fork of daniellemaywood.uk/gleam — Wasm codegen work
1<!--
2 SPDX-License-Identifier: Apache-2.0
3 SPDX-FileCopyrightText: 2026 The Gleam contributors
4-->
5
6# Public threat model
7
8Last updated: 2026-04-23
9
10For vulnerability reporting please see the [GitHub Security Advisories
11page](https://github.com/gleam-lang/gleam/security/advisories).
12
13## In scope
14
15- The Gleam compiler, build tool, language server, formatter, Hex package
16 manager client, and Wasm interface, all located in the `gleam-lang/gleam`
17 GitHub repository.
18- The precompiled binaries for Gleam published to GitHub releases for the
19 `gleam-lang/gleam` GitHub repository.
20- All Gleam packages within the `gleam-lang` GitHub organisation and their Hex
21 publications.
22- Gleam's GitHub Actions CI workflows and GitHub code repositories.
23- The Gleam websites:
24 - <https://gleam.run> (hosted with GitHub pages)
25 - <https://tour.gleam.run> (hosted with GitHub pages)
26 - <https://playground.gleam.run> (hosted with GitHub pages)
27 - <https://packages.gleam.run> (hosted with a Vultr VPS)
28
29## Out of scope
30
31- Security of third-party Gleam packages published to the Hex package manager.
32- Security of Hex package management system server-side components.
33- Securing of runtimes used by Gleam code, such as Erlang's BEAM and
34 JavaScript's V8.
35- Security of third-party operating system packages and installers for Gleam.
36
37## Assumptions
38
39- Third party providers such as GitHub, and Vultr meet their security
40 obligations and are not compromised.
41
42## Threats
43
44### GitHub account phishing or hijacking
45
46A bad actor could attempt to gain access to a GitHub account.
47
48- MFA is enforced for GitHub accounts.
49
50### Malicious or compromised Gleam GitHub organisation member account
51
52A bad actor with a `gleam-lang` member account could attempt to interfere with
53code repositories, actions workflows, and the content of issues, pull requests,
54and discussions.
55
56- Pull requests and reviews are required for making changes to code.
57- Regular members do not have permissions to perform destructive actions on GitHub.
58- Vandalised content within issues, pull requests, and discussions can be
59 restored by GitHub support.
60- Gleam's GitHub Actions workflows can be re-run without any side effects
61 beyond using workflow minutes.
62
63### Hex account phishing or hijacking
64
65A bad actor could attempt to gain access to a Hex account.
66
67- MFA is enforced for Hex accounts.
68
69### Malicious or compromised Hex account
70
71A bad actor with access to a Hex account could attempt to publish malicious
72versions of Gleam packages.
73
74- Hex requires MFA for destructive actions such as package publication.
75- Hex is immutable and existing package versions cannot be modified after
76 publication.
77- Hex provides tooling for viewing diffs between package versions to aid with
78 auditing new code.
79- Hex's security team will remove malicious package releases.
80- Gleam's Hex client always uses version locking to prevent differing versions
81 of dependencies from being added unintentionally.
82
83### Vultr account phishing or hijacking
84
85A bad actor could attempt to gain access to a Vultr account.
86
87- MFA is required for Vultr.
88
89### Vultr VPS infiltration attacks
90
91A bad actor could attempt to gain access to the Vultr VPS.
92
93- SSH authentication uses SSH keys and password authentication is disabled.
94- The VPS has a restrictive firewall enabled.
95- The VPS has automatic OS security updates enabled.
96- Minimal software is installed on the VPS and all workloads run inside
97 containers.
98
99### Compromised Vultr VPS
100
101A bad actor with root access to the VPS that serves the packages site could
102steal data from it or vandalise the website.
103
104- No secrets are stored on the VPS.
105- All configuration for the VPS is stored on GitHub so the VPS can be destroyed
106 and replaced quickly and easily.
107- The packages website data is public, so there is no threat of theft of
108 private data.
109- The packages website data can be recomputed from Hex and is backed-up
110 externally, so there is no threat of permanent data loss.
111
112### Malicious or compromised Rust dependency
113
114A bad actor with access to publish new versions of our Rust dependencies could
115attempt to inject malicious code into the `gleam` binary.
116
117- We use Rust's dependency version locking to avoid unexpected versions of
118 dependencies from being included in our application.
119- A cooldown period is used with dependabot to avoid including new dependency
120 versions that may not have been security scanned yet.
121- Dependency versions are not upgraded shortly before or during the RC process,
122 to minimise risk of new versions with vulnerabilities making it into a release.
123- The `cargo-deny` tool is used to alert when a dependency version used has a
124 published CVE.
125- GitHub code scanning and CodeQL is enabled to alert to further vulnerabilities.
126
127### Malicious or compromised Hex dependency
128
129A bad actor with access to publish new versions of our Hex dependencies could
130attempt to inject malicious code into the subtree of one of our Hex packages.
131
132- The Gleam core packages do not have any third-party dependencies.
133
134### Compromise or tampering of precompiled release binaries
135
136A bad actor could attempt to cause a malicious or modified binary to be
137published to GitHub Releases, or replace release assets after build.
138
139- The release workflow uses GitHub OIDC and artefact attestations to produce
140 provenance for release assets, published alongside release archives as
141 `.sigstore` files.
142- Checksums are provided for release archives for users' integrity checking.
143- The GitHub Actions workflow configuration files are scanned for
144 vulnerabilities using GitHub CodeQL.
145- GitHub Action versions are pinned using SHAs, and use of tools such as `gh`
146 is used instead of third-party Actions where possible.