We take security vulnerabilities seriously. If you discover a security issue in Signal Sentinel, please report it responsibly.

DO NOT create a public GitHub issue for security vulnerabilities.

Instead, please email: security@signalcoding.co.uk

Include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact assessment
• Any suggested remediation

1. Acknowledgement: We will acknowledge receipt within 48 hours
2. Assessment: We will assess the vulnerability within 7 days
3. Resolution: Critical vulnerabilities will be patched within 30 days
4. Disclosure: We will coordinate disclosure timing with you

We do not currently operate a bug bounty program, but we will publicly acknowledge security researchers who report valid vulnerabilities (with their permission).

Signal Sentinel is built to comply with:

• OWASP Top 10 2025 - Web application security
• OWASP Agentic AI Top 10 (2026) - AI agent security (ASI01-ASI10)
• OWASP Agentic Skills Top 10 (2026) - skill authoring supply chain (AST01-AST10) - see owasp-ast-mapping.md
• MOD JSP 440/656 - UK Defence secure development
• NCSC Cyber Essentials Plus - UK government security baseline

• All code changes require security-focused review
• Security-critical changes require senior review

• All dependencies are pinned to exact versions
• Automated vulnerability scanning in CI/CD
• No packages with known critical vulnerabilities

• No secrets in source code
• Azure Key Vault / cloud-native secret stores only
• Credentials never appear in logs

• SBOM generated for every release
• Package integrity verification
• Official registries only (NuGet, npm)

Signal Sentinel Scanner is a fast, deterministic, offline-capable first-pass authoring aid - one layer in a defence-in-depth chain, not a standalone audit. Pair it with a semantic scanner and a code-level scanner for audit-grade verification. See CHANGELOG.md for release history and docs/MIGRATION_V3.md for v3.0 upgrade guidance.

• 47 security rules across MCP server and Agent Skill scanning (41 detection + 6 informational)
• v3.0.2 skill-scan noise pass:
  • SS-012 (Skill Scope Violation) now detects verb-shaped capability mentions (e.g. "download the file from https://...", "write files to..."), not bare nouns (https in a URL, "the filesystem"); conjugated verbs and tool-call shapes are recognised; skill descriptions with declared file/document production are trusted.
  • SS-024 (Skill Not Signed) reclassified to Informational; the strict preset pins it to High so --policy strict still gates on unsigned skills.
  • Scanner no longer grades better than its score band: a High-heavy scan scoring below the C threshold (50) now grades D, not C; the scoring rubric v2.0.0 is unchanged (weights and thresholds identical).
• v3.0.1 skill-rule accuracy pass:
  • Skill rules validated against a real-world third-party corpus (Anthropic's public skills repo) and its false-positive class fixed as a whole: YAML block-scalar descriptions parse, SS-018 uses document segmentation, SS-011/SS-014/SS-015/SS-016 patterns are shaped (access verb, destination, object, tool noun) rather than keyword-matched; every narrowing has a migration note in CHANGELOG.md.
  • Regex engine guard: shipped patterns are tested for agreement between the source-generated and interpreted .NET engines after a .NET SDK 10.0.401 miscompile of lazy bounded group loops was found and removed.
  • Markdown report evidence is escaped (newlines, backticks) so script content cannot break out of a code span.
• v3.0.0 accuracy and coverage reset:
  • Markdown-aware segmentation: skill rules evaluate frontmatter, prose, fenced code, inline code and link segments separately, eliminating whole classes of v2.x false positives; see docs/MIGRATION_V3.md.
  • Keyword-level triggers pruned and documented in docs/keyword-rules.md; fetch( exfiltration detection is scoped to js/ts fenced code and bundled scripts.
  • New surfaces: prompt/resource/server-instructions injection (SS-030..SS-032), unsolicited requests (SS-033), skill forensics (SS-034/SS-035), homoglyph and description-overlap detection (SS-036/SS-037), fetch-to-exec taint (SS-038), OSV dependency lookups (SS-039, --osv), error-channel injection (SS-040), server-source sinks (SS-041, --server-source), A2A agent cards (SS-042, --agent-card).
  • Policy presets (--policy default|strict|defence) and a versioned, auditable scoring rubric (--rubric, v2.0.0) with property-tested monotonicity.
• v2.3.0 credibility hardening:
  • .sentinel-suppressions.json schema v1.0 for accepted-risk management, with justification, approver, expiry, and per-environment scoping. Suppressed findings are retained in every report format for audit.
  • Confidence-aware triage: --min-confidence hard filter and --triage demotion mode (see confidence-rubric.md).
  • Scan history + diff (sentinel-scan diff) attributes grade changes to the rules that caused them.
  • Non-MCP endpoint detection (SS-INFO-001) prevents misleading grades when --remote targets a non-MCP HTTP host. When it fires, all MCP-protocol rules for that target are automatically suppressed to keep reports internally consistent.
  • Skill YAML capabilities: block is authoritative for SS-012; declared capabilities are trusted over prose heuristics, eliminating false positives on "disk/memory/CPU" style descriptions.
  • Lemma table for SS-012 extended with filesystem synonyms (disk, volume, mount, /proc, /sys, /dev, procfs, sysfs) so operator-friendly descriptions no longer trigger scope-violation findings.
  • Suppressed scans surface a technical-debt exposure banner showing the counter-factual grade ("would be F instead of A") so suppressions cannot be used to hide risk.
  • Every report declares explicit scope (scanned, not scanned, complementary tools) in line with the "first-pass authoring aid" positioning.
  • Pre-commit hook integrations for pre-commit.com, lefthook, and husky.
• MCP rules (SS-001..SS-010, SS-019..SS-023, SS-025, SS-030..SS-033, SS-040): tool poisoning, overbroad permissions, missing auth, supply chain, code execution, memory write, inter-agent comms, sensitive data, credential hygiene, OAuth 2.1 compliance, package provenance, rug pull detection, shadow tool injection, excessive response size, prompt/resource/instructions injection, unsolicited server requests, error-channel injection
• Skill rules (SS-011..SS-018, SS-024, SS-026, SS-028, SS-029, SS-034..SS-039): prompt injection, scope violation, credential access, data exfiltration, obfuscation, script payloads, excessive permissions, hidden content, skill integrity verification, instructional descriptions, identity-file writes, unpinned dependencies, checksum verification, file forensics, confusables, description overlap, pipeline taint, dependency vulnerabilities
• Static surfaces beyond live MCP: server-source sink analysis (SS-041) and A2A agent card evaluation (SS-042). Full current list: sentinel-scan --list-rules
• Cross-server attack path analysis
• Supply chain integrity checks (hash pinning, typosquat detection, Levenshtein distance)
• Baseline comparison with SHA-256 schema hashing for rug-pull detection
• Offline mode (--offline) enforces zero network egress for air-gapped / HMG environments
• SARIF v2.1.0 output compatible with GitHub Code Scanning
• Sigma YAML rule import for shared SOC detection content
• OWASP Agentic AI Top 10 (ASI01-ASI10) + OWASP MCP Top 10 (MCP01-MCP10) dual compliance mapping
• v2.1.1: SHA-pinned CI/CD, SSRF protection, symlink escape protection, regex timeouts, TLS enforcement, bounded reads
• v2.2.0: Deduplication engine collapses duplicate findings; integrity verifier detects unsigned skills

• Real-time tool call filtering
• Response sanitisation (injection pattern removal)
• PII redaction
• Anomaly detection and kill switch

• Security issues: security@signalcoding.co.uk
• General inquiries: info@signalcoding.co.uk

Copyright 2026 Signal Coding Limited. All rights reserved.