SECURITY.md

April 27, 2026 · View on GitHub

Hack23 Logo

🛡️ EU Parliament Monitor — Security Policy

Vulnerability disclosure · Severity SLAs · Compliance posture · Accepted risks
🔐 Responsible disclosure · 🚨 48h ack · ⚖️ ISO 27001 / NIS2 / EU CRA aligned · 🤝 Coordinated public credit

Owner Version Classification Review Cycle Effective

Report Security Advisory Email security@hack23.com Hack23 ISMS

OpenSSF Scorecard OpenSSF Best Practices SLSA 3 CodeQL Scorecards

📋 Document Owner: CEO | 📄 Version: 1.1 | 📅 Last Updated: 2026-04-27 (UTC) 🔄 Review Cycle: Quarterly | ⏰ Next Review: 2026-07-27 | 🏷️ Classification: Public

🎯 Purpose & Scope

This Security Policy documents how to report vulnerabilities in the EU Parliament Monitor platform, the severity-based remediation SLAs we commit to, the compliance frameworks we align with, and the accepted residual risks we explicitly carry. It is the public face of the broader SECURITY_ARCHITECTURE.md and operates under the Hack23 ISMS Vulnerability Management Policy.

🔗 Sister policies: SECURITY_ARCHITECTURE.md (C4 controls + threat model) · THREAT_MODEL.md (STRIDE for software-security context) · CRA-ASSESSMENT.md (EU Cyber Resilience Act conformity) · CLASSIFICATION.md (CIA triad + BCP impact bands).

📦 Supported Versions

This project is under active development. Security updates are provided for the latest released version only. Always upgrade to the most recent release for security fixes.

🏷️ Version🛡️ Supported📅 EOL
latest (main)✅ Active—
Older releases❌ End of lifeUpgrade required

🚨 Reporting a Vulnerability

We take the security of the EU Parliament Monitor project seriously. If you discover a potential vulnerability, please report it privately so we can assess and remediate before public disclosure.

🎯 What constitutes a vulnerability

CategoryExamples
💉 InjectionXSS, HTML injection, Markdown-it sanitization bypass
🔐 Auth/AuthzOIDC misconfiguration, GitHub Actions secret leakage
📦 Supply chainInsecure dependencies, compromised vendored bundle (Mermaid/Chart.js/D3)
🔓 Data exposureSensitive data exposure, GDPR boundary violation
⚙️ MisconfigurationInsecure defaults, CSP bypass, S3/CloudFront exposure
✋ ValidationInsufficient input validation in MCP payload handling

🛠️ How to privately report (preferred — GitHub Security Advisory)

  1. Visit github.com/Hack23/euparliamentmonitor
  2. Click the Security tab → Advisories → Report a vulnerability
  3. Fill in: description, reproduction steps, potential impact, suggested mitigation
  4. Submit — maintainers are notified privately and you become a collaborator on the advisory

✉️ Alternative reporting

ChannelAddressUse when
🔒 GitHub AdvisoryReport hereDefault — preferred
📧 Emailsecurity@hack23.comGitHub unavailable; subject line [SECURITY] EU Parliament Monitor — <brief description>

⏱️ Disclosure Timeline & Severity SLAs

Upon receipt of a vulnerability report:

PhaseTargetAction
🔵 Acknowledge≤ 48 hoursConfirm receipt and assign internal handler
🟡 Validate≤ 7 daysReproduce, classify CVSS severity, assign CVE if applicable
🟢 RemediatePer SLA belowDevelop, test, and release patch or mitigation
🟣 PublishAfter patchCoordinated public advisory with reporter credit

🎚️ Severity-based remediation SLAs

Per the Hack23 ISMS Vulnerability Management Policy:

🚦 SeverityCVSS v3.1⏰ Remediation SLA📝 Description
🔴 Critical9.0 – 10.07 daysImmediate threat, active exploitation possible
🟠 High7.0 – 8.930 daysSignificant security impact
🟡 Medium4.0 – 6.990 daysModerate security impact
🟢 Low0.1 – 3.9Best effortMinimal security impact

🧪 Security Testing

We employ multiple defence-in-depth layers, all wired into CI/CD:

🔬 LayerToolTrigger
🛠️ SASTCodeQLPush, PR, weekly schedule
📦 SCADependabot + npm auditDaily, PR validation
✅ Unit security testsVitest (≥80% coverage)Every commit
🌐 DASTPlaywright + axe-core (accessibility-as-security)PR + nightly
🏆 Supply chainOpenSSF Scorecard + SLSA L3 attestationsWeekly + on release
📜 License complianceREUSEPush, PR, weekly

📊 See SECURITY_ARCHITECTURE.md § Security Testing for full coverage details.

🎯 Scope

✅ In scope

  • 📰 News generation scripts (scripts/)
  • 🟢 Analysis-artifact aggregator (src/aggregator/** — artifact-order.ts, clean-artifact.ts, analysis-aggregator.ts, markdown-renderer.ts, article-html.ts, article-metadata.ts, article-generator.ts CLI)
  • 🧹 HTML sanitiser (src/utils/html-sanitize.ts) and the markdown-it render pipeline with explicit plugin allowlist (markdown-it-anchor, markdown-it-footnote, markdown-it-attrs, markdown-it-deflist)
  • 🔌 MCP clients (src/mcp/** — European Parliament, IMF, World Bank) including the getVotingRecordsWithFallback() three-state fallback to the EP Open Data Portal
  • 🧠 Committed analysis artifacts under analysis/daily/** (attack surface for aggregator rendering)
  • 🎨 Vendored client-side diagram renderer (js/vendor/mermaid/ etc.) under strict script-src 'self' CSP
  • 📄 HTML templates and rendered output (news/*.html, language variants)
  • 🤖 GitHub Actions and gh-aw agentic workflows (.github/workflows/news-*.md — 8 unified news-<type>.md + news-translate.md)
  • ☁️ AWS S3 + CloudFront deployment pipeline (deploy-s3.yml, OIDC GithubWorkFlowRole)
  • 📦 Dependencies and supply chain (OpenSSF Scorecard + SLSA L3 provenance + SBOM)

❌ Out of scope

  • 🌐 Third-party services (GitHub, European Parliament APIs, IMF SDMX REST, World Bank Open Data)
  • 🏗️ Infrastructure (AWS account-level, GitHub Pages hosting as fallback runbook)
  • 🖥️ Client-side browser vulnerabilities not under platform control

🏆 Recognition & Anonymity

ChannelWhat you get
📋 Release notesReporter credit (with consent)
📜 Security advisoryPublic acknowledgment in the GHSA
🌟 Public GitHub recognitionCredit on the advisory page (unless anonymity requested)
🏅 Security Hall of FameRepeat or high-impact contributors considered

We respect anonymity requests — opt out at any point in the disclosure flow.

📐 Compliance Frameworks

EU Parliament Monitor aligns with the following frameworks. Evidence is traceable through ISMS-PUBLIC, the SECURITY_ARCHITECTURE compliance matrix, and the CRA-ASSESSMENT conformity table.

🏛️ Framework📌 Scope📂 Evidence
ISO 27001:2022Information security managementSECURITY_ARCHITECTURE § Compliance Matrix
NIST CSF 2.0Identify · Protect · Detect · Respond · RecoverSECURITY_ARCHITECTURE § NIST CSF
CIS Controls v8.118 critical security controlsCodeQL, Dependabot, npm audit, SBOM
GDPRData minimisation, purpose limitationEP open data only, no profiling
NIS2Article 20–21 cybersecurity risk managementTHREAT_MODEL.md (STRIDE software context)
EU Cyber Resilience ActSBOM, vulnerability disclosure, Annex I/VCRA-ASSESSMENT.md, SLSA provenance
OWASP Top 10Web-app security best practicesSame-origin CSP, sanitised rendering

📊 Security Metrics (live posture)

MetricTargetCurrent
🟢 Known vulnerabilities (npm audit)0 production0 (2 documented dev-only accepted risks — see below)
🟢 Code coverage with security tests≥ 80 % line82 %+
🟢 Dependency-scanning coverage100 %100 %
🟢 CodeQL critical/high findings00
🟢 OpenSSF Scorecard≥ 7.0Live score
🟢 SLSA build levelL3Attestations

📈 See SECURITY_ARCHITECTURE.md § Security Metrics for trend data.

🟡 Accepted Risks (documented dev-only false positives)

The following advisories are detected by npm audit and explicitly allow-listed in .github/workflows/test-and-report.yml (Security Check job). Both are dev-only and do not reach end-user runtime:

🆔 GHSA📦 Package🚦 Severity📂 Path📝 Justification
GHSA-2g4f-4pwh-qvx6ajv (via ESLint)🟡 Moderate (ReDoS)devDepESLint does not invoke ajv with the $data option; only triggered on attacker-controlled JSON schemas, which we never feed it. Resolves with the ESLint 10 upgrade.
GHSA-w5hq-g745-h8pquuid <14.0.0 (via mermaid)🟡 Moderate (buffer bounds)devDepmermaid is a build-time-only dependency. Library is vendored to js/vendor/mermaid/ and renders diagrams from analyst-authored Markdown that has passed the Stage-C completeness gate; user input never reaches uuid.v3/v5/v6 with an attacker-controlled buf argument. The site is fully static — no server-side mermaid execution.

⚠️ Drift guard: if npm audit reports any GHSA outside this list, the Security Check job MUST fail. Allow-listing requires a pull request that updates this table and the workflow allow-list together.

📚 Security Resources

ResourceLink
🛡️ Threat modelSECURITY_ARCHITECTURE § Threat Model
🔐 Security controlsSECURITY_ARCHITECTURE § Security Controls
🚒 Incident responseHack23 ISMS Incident Response Plan
🐛 Vulnerability managementHack23 ISMS Vulnerability Management
🏛️ Information security policyHack23 ISMS Information Security Policy
🛠️ Secure development policyHack23 ISMS Secure Development Policy
🔍 Threat modelling policyHack23 ISMS Threat Modeling
📋 Classification frameworkHack23 ISMS Classification
⚖️ EU CRA conformity assessmentCRA-ASSESSMENT.md

🌐 Hack23 Ecosystem

EU Parliament Monitor is part of the broader Hack23 civic-tech and security portfolio:

🏛️ Project🎯 Focus🔗 Link
🌐 Hack23 HomepageOrganisation site, ISMS hubhack23.com · Hack23/homepage
📜 ISMS-PUBLICPublic ISO 27001 / NIST CSF / CIS / GDPR / NIS2 / EU CRA policiesHack23/ISMS-PUBLIC
🔌 European Parliament MCP ServerTypeScript MCP server with 60+ EP open-data toolsHack23/European-Parliament-MCP-Server
🇸🇪 Riksdag MonitorSwedish Parliament monitor (sister project)Hack23/riksdagsmonitor
🕵️ CIASwedish Parliament intelligence platform (Java/Spring)Hack23/cia
✅ CIA Compliance ManagerCIA-triad compliance dashboard (TypeScript)Hack23/cia-compliance-manager
🥋 Black TrigramKorean martial-arts game with security focusHack23/blacktrigram

📞 Contact

ChannelUse for
🔒 GitHub Security AdvisoryVulnerabilities (preferred)
✉️ security@hack23.comVulnerabilities (alternative)
🐛 GitHub IssuesNon-security bugs and feature requests
💬 GitHub DiscussionsQ&A, design discussions
📧 info@hack23.comGeneral inquiries
🤝 conduct@hack23.comCode of Conduct concerns

🙏 Thank you for helping us keep EU Parliament Monitor and its users safe. Your contributions to our security posture are deeply appreciated.

Maintained by Hack23 AB — Intelligence Operations Team under the Hack23 ISMS framework.