Security audits¶

Li treats compiler robustness and parallel safety as security properties.

1. Malformed input (no crashes)¶

Goal: Attacker-controlled .li text must not crash lic.

Harness: li-tests/run_security.sh

Rule: exit code 0 or 1 only — never signal (segfault, abort).

CI: every scripts/ci.sh on Linux/macOS; Windows job runs the same harness.

2. CVE-informed catalog¶

Goal: Map public C memory-safety CVE classes to Li tests and mitigations.

Harness: li-tests/cve_patterns/ — CWE-named programs that must not compile (plus good_* controls).

CI: scripts/ci-security.sh runs on Linux, macOS, and Windows (via scripts/ci.sh and the Windows CI job):

• Malformed-input corpus (run_security.sh)
• All cve_patterns manifest entries (every mapped CWE)
• Catalog ↔ test alignment (check-cve-coverage.sh)
• Path injection rejects (codegen_path_injection.sh)

Workflow: .github/workflows/cve-catalog.yml validates the catalog on all three OSes on every PR; weekly NVD/OSV refresh opens a bot PR (human review only when mappings change).

See also SECURITY.md for disclosure and refresh policy.

Historic failures (OS-ready)¶

security/historic-bugs.toml maps famous incidents to Li rules so a future Li kernel does not repeat C-era mistakes:

Validated on Linux, macOS, Windows via scripts/check-historic-bugs.sh (automated; human only when adding rows).

Web server / reverse-proxy classes¶

See Web server security for nginx/Apache CVE classes (smuggling, path traversal, SSRF, Slowloris, …) mapped to what Li already enforces in the language vs what li-httpd will add at config/parse time.

Registry: security/webserver-bugs.toml — scripts/check-webserver-bugs.sh on every OS in ci-security.sh.

3. Parser fuzzing (continuous)¶

Tools: parse_fuzz, check_fuzz (libFuzzer + Clang)

Workflow: .github/workflows/fuzz.yml

Corpus learning:

1. Download prior fuzz-corpus artifact.
2. Run fuzz with crash artifacts saved.
3. scripts/merge_fuzz_corpus.sh dedupes and adds regressions/.
4. Bot opens PR with new seeds (on main schedule).

4. Parallel race exploits¶

Goal: Unsafe shared memory must not compile.

Harness: li-tests/race_shared_memory/ + manifest.toml

Documented in Tests overview.

5. Policy gate (forbidden constructs)¶

compiler/types/policy.cpp rejects:

• Any
• Obvious parallel anti-patterns (shared slot writes, missing disjoint, …)
• Decorator exploits (Phase 7d-e): reserved_name, typosquat_reserved, decorator_name_too_short, reserved_prefix, @parallel( without disjoint=

Harness: li-tests/decorator_exploits/ — run via ./li-tests/run_all.sh decorator_exploits (also in scripts/ci.sh).

This complements Lean, not replaces it. See Provability gaps (G-dec).

6. Memory CI (Linux)¶

scripts/memory-ci.sh:

• Security corpus again
• RSS profiling
• ASan build of MD kernel / lic when available
• ASan smoke of runtime/li_rt.c (profile-memory.sh --asan-rt)

UBSan: .github/workflows/ubsan-lic.yml (weekly lic build with -DLI_SANITIZE=undefined).

Trusted C audit: security/trusted-c-audit.toml — manual matrix for li_rt.c and reference kernels.

7. What we do not claim yet¶

Reporting issues¶

For security-sensitive reports, follow SECURITY.md.

For general robustness bugs, open a GitHub issue with:

• Input file (minimal)
• lic version / commit
• Expected vs actual (crash vs diagnostic)