copilot-swe-agent[bot]
5bddbb42f5
Agent-Logs-Url: https://github.com/christianlouis/InboxConverge/sessions/902f3b74-792c-4afa-8aae-96611262ee5f Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
23 lines
1.0 KiB
YAML
23 lines
1.0 KiB
YAML
# Safety policy configuration
|
||
# See: https://docs.safetycli.com/safety-docs/safety-policy-file
|
||
|
||
version: "3.0"
|
||
|
||
security:
|
||
ignore-cvss-severity-below: 0
|
||
ignore-cvss-unknown-severity: false
|
||
ignore-vulnerabilities:
|
||
# ecdsa CVE: side-channel / Minerva attack (CVE-64396, CVE-64459)
|
||
# The ecdsa maintainers have explicitly stated that these vulnerabilities
|
||
# cannot be fixed in pure Python. ecdsa is a transitive dependency of
|
||
# python-jose[cryptography], which is used only for JWT token
|
||
# verification/signing – a context where precise timing side-channels
|
||
# are not exploitable by remote attackers. The 'cryptography' package
|
||
# (already installed) handles all sensitive key operations.
|
||
64396:
|
||
reason: "ecdsa side-channel (Minerva) — unfixable in pure Python per maintainers; not exploitable in our JWT-signing context"
|
||
expires: "2027-01-01"
|
||
64459:
|
||
reason: "ecdsa side-channel attack — unfixable in pure Python per maintainers; not exploitable in our JWT-signing context"
|
||
expires: "2027-01-01"
|