[eu-cra-compliance:vulnerability-handling-auditor] github/gh-aw-firewall CRA vulnerability handling audit

github/gh-aw-firewall has a public security policy and multiple automated scanning workflows, but the evidence for acknowledgements, vulnerability SLA timestamps, supported-version handling, and Article 14 escalation linkage is incomplete from the accessible repo snapshot. The main next step is to have the maintainer review and document the missing lifecycle controls without exposing private advisory details.

**Action:** Maintainer review is required. Confirm the complete vulnerability lifecycle controls and either document the missing public process evidence or link the internal controlled records; acceptance check: each GAP_FOUND or INCOMPLETE row below has an owner and disposition.

`target_repo`: `github/gh-aw-firewall`
`target_sha`: `42cf8f65ee3a3cc6387cd23c2ac20dcc84f458b0`

### Status summary
- Overall result: `GAP_FOUND`
- Human review needed: CRA scope/classification, reportability/escalation threshold decisions, and whether internal private processes satisfy missing public evidence.
- What's working: public intake guidance is easy to find, and dependency/code/supply-chain scanning are already automated on a recurring basis.

### Lifecycle control matrix
| Topic | Status | Evidence / gap | Source | Verified |
|---|---|---|---|---|
| Public vulnerability disclosure policy and confidential intake channel | EVIDENCE_SUFFICIENT | `docs/security.md` instructs reporters not to use public issues and to email `opensource-security[@]github.com`; GitHub repo metadata also exposes `securityPolicyUrl`. | `target/docs/security.md`; `https://github.com/github/gh-aw-firewall/security/policy` | 2026-09-16 |
| Researcher coordination expectations | EVIDENCE_SUFFICIENT | Policy asks for reproduction, affected code location, and impact details, which supports coordinated handling. | `target/docs/security.md` | 2026-09-16 |
| Acknowledgement process/timestamp preservation | INCOMPLETE | No accessible evidence in the checkout for acknowledgement SLA, acknowledgement owner, or preserved receipt timestamps for vulnerability reports. Private inbox/process records were not accessible in this run. | `target/docs/security.md` (no acknowledgement workflow detail found) | 2026-09-16 |
| Confidentiality / non-public reporting path | EVIDENCE_SUFFICIENT | Policy explicitly says not to report vulnerabilities through public issues, discussions, or pull requests. | `target/docs/security.md` | 2026-09-16 |
| Triage ownership | GAP_FOUND | `.github/CODEOWNERS` identifies maintainer ownership for code areas, but no explicit vulnerability triage owner, role, or routing process was found. | `target/.github/CODEOWNERS` | 2026-09-16 |
| Severity / exploitability assessment method | INCOMPLETE | No documented severity rubric, exploitability scoring method, or decision record template was found in accessible files. | checkout search of target repo | 2026-09-16 |
| Affected-version identification and supported-version inventory | GAP_FOUND | The repo has release-note configuration, but no public supported-version inventory, support-period policy, or end-of-support process was found. | `target/.github/release.yml`; checkout search of target repo | 2026-09-16 |
| Root-cause analysis and remediation decision records | INCOMPLETE | Commit and issue references show bug/root-cause discussions for some defects, but no durable vulnerability RCA process or controlled record pattern was evidenced without reading private advisories. | sampled grep hits in workflow docs; no dedicated vulnerability RCA process file found | 2026-09-16 |
| Dependency vulnerability monitoring | EVIDENCE_SUFFICIENT | Dependabot is scheduled weekly for npm, docker, and GitHub Actions ecosystems; `dependency-audit.yml` runs weekly and on push/PR, uploads SARIF, and enforces zero high/critical npm findings when advisory service is available. | `target/.github/dependabot.yml`; `target/.github/workflows/dependency-audit.yml` | 2026-09-16 |
| Code scanning / product vulnerability discovery | EVIDENCE_SUFFICIENT | `codeql.yml` runs on push, PR, weekly schedule, and manual dispatch for JavaScript/TypeScript and Actions. | `target/.github/workflows/codeql.yml` | 2026-09-16 |
| Component / supply-chain identification and scanning | EVIDENCE_SUFFICIENT | `supply-chain-scan.yml` compiles SBOMs with Syft and scans images with Grype/Grant, including a blocking PR gate for rebuilt first-party images. | `target/.github/workflows/supply-chain-scan.yml` | 2026-09-16 |
| Security fixes and update distribution | EVIDENCE_SUFFICIENT | Release-note automation exists and workflow comments mention CVE fixes in release content; however exact customer notification practice for security updates is only partially evidenced publicly. | `target/.github/release.yml`; `target/.github/workflows/release.yml` | 2026-09-16 |
| Rollback / mitigation process | INCOMPLETE | No explicit rollback or temporary-mitigation procedure for security fixes was found in accessible docs. | checkout search of target repo | 2026-09-16 |
| Customer / user communication for vulnerabilities | GAP_FOUND | Public security policy explains intake, but no public template/process for security advisories, release-note security notices, or end-user security communication was found. | `target/docs/security.md`; `target/.github/release.yml` | 2026-09-16 |
| Coordinated upstream/downstream disclosure and CNA/CVE practice | INCOMPLETE | No explicit CNA/CVE issuance or upstream/downstream coordination procedure was found in accessible materials. Absence of public text is not evidence the private process does not exist. | checkout search of target repo | 2026-09-16 |
| Handling withheld details | INCOMPLETE | Confidential intake exists, but no public criteria for withholding technical details pending remediation were found. | `target/docs/security.md` | 2026-09-16 |
| Article 14 escalation linkage | GAP_FOUND | No accessible runbook or pointer linking vulnerability handling to an Article 14 severe-incident / actively exploited vulnerability escalation path was found. Human review is required; this audit does not decide reportability. | checkout search of target repo | 2026-09-16 |
| Preservation of awareness / decision / corrective-action / release timestamps | INCOMPLETE | Git history preserves file-change timestamps for sampled security workflow/docs changes, but no end-to-end vulnerability case record with intake, triage, fix, release, and communication timestamps was accessible. | `git log` on sampled files in target checkout | 2026-09-16 |

### Sampled traceability
- `docs/security.md` provides the intake path and confidentiality instructions.
- `.github/dependabot.yml` covers npm, docker, and GitHub Actions on weekly cadence.
- `.github/workflows/codeql.yml` provides recurring code scanning.
- `.github/workflows/dependency-audit.yml` uploads SARIF and blocks high/critical npm findings when advisory service responses are available.
- `.github/workflows/supply-chain-scan.yml` generates SBOMs and performs CVE/license scanning, with a blocking gate for PR-built images.
- `git log` for sampled security-control files shows at least current-repo timestamp preservation for control changes, but not full vulnerability-case timestamps.

### Prioritized gaps
1. `GAP_FOUND` — define or publish the vulnerability triage owner, severity method, and supported-version/support-period policy.
2. `GAP_FOUND` — add or reference the controlled Article 14 escalation path for vulnerabilities/security incidents requiring human legal/regulatory review.
3. `GAP_FOUND` — document how security fix communications reach users, including supported-version and end-of-support notices.
4. `INCOMPLETE` — confirm internal acknowledgement, RCA, timestamp, CNA/CVE, and withheld-detail procedures from controlled evidence.

### Regulatory baseline checks
| Topic | Status | Claim |
|---|---|---|
| CRA legal baseline dates | HUMAN_REVIEW_REQUIRED | The workflow required verification against official EU sources, but direct access to the EUR-Lex regulation page was blocked by a web application firewall challenge from this sandbox. No contradictory date evidence was introduced here; human verification against official sources is still required for 10 Dec 2024, 11 Jun 2026, 11 Sep 2026, and 11 Dec 2027. |
| Commission guidance dated 27 July 2026 | EVIDENCE_SUFFICIENT | The European Commission CRA policy page was reachable and contained `27 July 2026` together with CRA guidance references, but guidance remains non-binding. |

### Material regulatory findings
- Requirement/topic: vulnerability handling obligations need human mapping to CRA scope/classification and any Article 14 reporting path for this product. Status: `HUMAN_REVIEW_REQUIRED`.
```yaml
source:
instrument: "Regulation (EU) 2024/2847"
provision: "Articles 13 and 14; Annex I Part II (topic mapping only, not legally determined here)"
authority: "binding"
```
Official URL: `https://eur-lex.europa.eu/eli/reg/2024/2847/oj`
Verification date: `2026-09-16`

- Requirement/topic: Commission CRA guidance may help interpret implementation expectations but MUST NOT be treated as binding. Status: `EVIDENCE_SUFFICIENT`.
```yaml
source:
instrument: "European Commission CRA guidance"
provision: "Guidance page dated 27 July 2026"
authority: "non-binding"
```
Official URL: `https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act`
Verification date: `2026-09-16`

### Inaccessible or non-public evidence
- Private security advisory workflows, mailbox handling records, and acknowledgement timestamps: `INCOMPLETE`.
- Internal severity/risk rubric, vulnerable-version tracking, and release-communication runbooks: `INCOMPLETE`.
- Any regulator-reportability or active-exploitation decisions: `NOT_ASSESSED` pending authorized human review.

### Human decisions required
- Determine CRA applicability, economic-operator role, and any product classification implications for `github/gh-aw-firewall`.
- Determine whether any internal private process already satisfies the missing controls and whether a public summary should be published.
- Determine whether Article 14 escalation criteria, reportability, or active-exploitation handling apply; this record does not decide them.

### Human Acceptance
A non-bot reviewer SHOULD add a thumbs-up reaction only after reviewing the complete vulnerability lifecycle controls, process evidence, traceability, prioritized gaps, inaccessible evidence, and human decisions.

### Control Plane
- Correlation ID: `35111435260-322`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/35111435260`

> Generated by [:bug: EU CRA / Vulnerabilities](https://github.com/githubnext/gh-aw-cao/actions/runs/35112084989) · pi · gpt54 · 24.9 AIC · ⊞ 9.8K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Feu-cra-compliance-vulnerability-handling-auditor%22&type=issues)
> - [x] expires on Oct 16, 2026, 3:04 PM UTC

Start with docs/security.md, .github/CODEOWNERS, .github/release.yml, and the dependency-audit.yml, codeql.yml, and supply-chain-scan.yml workflows. Review each GAP_FOUND or INCOMPLETE row with the maintainer, including CRA scope and Article 14 decisions, then document public evidence or link controlled records without exposing advisory details. Done means every such row has an owner and disposition.

Written by the indexing model from the issue text.