Skip to main content
Cloudrustfs

security-advisory-lessons

Apply RustFS security lessons distilled from repository GitHub Security Advisories. Use when making or reviewing RustFS code changes, doing security checks, handling PR review for auth/authz, IAM, storage, RPC, logging, CORS, console/browser, encryption, policy, or endpoint changes, and when deciding which security regression tests are required.

Stars
28,174
Source
rustfs/rustfs
Updated
2026-05-31
Slug
rustfs--rustfs--security-advisory-lessons
View on GitHubRaw SKILL.md

// install — copy + paste into any project

mkdir -p .claude/skills && curl -fsSL https://raw.githubusercontent.com/rustfs/rustfs/HEAD/.agents/skills/security-advisory-lessons/SKILL.md -o .claude/skills/security-advisory-lessons.md

Drops the SKILL.md into .claude/skills/security-advisory-lessons.md. Works with Claude Code, Cursor, and any agent that loads SKILL.md files from .claude/skills/.

RustFS Security Advisory Lessons

Use this skill as the deep security lens. For a normal adversarial review with a matched security surface, the concise security reference under adversarial-validation is sufficient.

Workflow

  1. Freeze the exact diff/head and identify the changed trust boundaries.
  2. Inspect the headings in advisory-patterns.md, then read the matching sections. Read the full map only for a broad security audit. Useful headings are auth/admin, IAM/STS/OIDC, policy/plugins, S3/copy/multipart, protocols, paths, secrets/logging/RPC, browser/CORS/proxy, SSE, Object Lock, and serde.
  3. Trace unauthenticated, low-privilege, wrong-action/owner/bucket, malformed, and default-config cases. Security decisions must fail closed.
  4. Require a focused negative regression test for the bypass/exploit form, not only the intended success path. State residual risk when a test is impractical.
  5. Report proven vulnerabilities separately from defense-in-depth hardening.

When advisory currentness matters, fetch the live inventory instead of treating the reference as a status mirror:

gh api repos/rustfs/rustfs/security-advisories --paginate \
  --jq '.[] | {ghsa_id,state,severity,summary,updated_at}'

Fetch an individual advisory only when the live summary indicates a new or changed lesson.

Finding Standard

Each finding includes severity, file:line, attacker prerequisites, concrete input/path, impact, smallest safe fix, and a regression check. Do not exaggerate unauthenticated impact when the actual issue requires authenticated low privilege.