Security/review remediation

.github/workflows/lint.yml

@@ -9,17 +9,25 @@ on:
     branches:
       - main
 
+# Default to read-only; the lint job below grants itself the write scopes
+# lint-action actually needs (auto-fix commits + check-run annotations).
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: Run black linter
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # auto_fix: true pushes formatting commits back to the branch
+      checks: write # lint-action publishes results as a check run
     steps:
       - name: Check out Git repository
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
       - name: Install Python dependencies
-        run: pip install black
+        run: pip install black==26.5.1 # match the pin in requirements-dev.txt
       - name: Run black
         uses: wearerequired/lint-action@548d8a7c4b04d3553d32ed5b6e91eb171e10e7bb # v2
         with:

.github/workflows/release.yml

@@ -4,9 +4,17 @@ on:
     tags:
       - 'v*'
 
+permissions:
+  contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      # Required for PyPI Trusted Publishing (OIDC) below; no PYPI_API_TOKEN
+      # secret is used or needed once a trusted publisher is configured.
+      id-token: write
 
     steps:
     - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
@@ -18,14 +26,18 @@ jobs:
 
     - name: Install dependencies
       run: |
-        python -m pip install --upgrade pip
-        python -m pip install flit
+        python -m pip install --upgrade "pip>=26.2" # CVE-2026-8643, CVE-2026-6357, CVE-2026-13346, CVE-2026-3219
+        python -m pip install flit==3.12.0 # match flit_core pin in pyproject.toml
 
     - name: Build package
       run: flit build
 
     - name: Publish package
-      uses: pypa/gh-action-pypi-publish@release/v1
-      with:
-        user: __token__
-        password: ${{ secrets.PYPI_API_TOKEN }}
+      # SECURITY_REVIEW.md SDK-5 / DevPlan.md 3.3: migrated from a long-lived
+      # PYPI_API_TOKEN to PyPI Trusted Publishing (OIDC), and the action ref
+      # is now SHA-pinned (it was previously the mutable `release/v1` branch).
+      # REQUIRES: a trusted publisher for this repo + workflow file must be
+      # configured on pypi.org (project Settings -> Publishing) before this
+      # tag push will succeed. Coordinate with the PyPI project owner first;
+      # keep the PYPI_API_TOKEN repo secret until that is confirmed working.
+      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

.github/workflows/run_tests.yml

@@ -2,6 +2,11 @@ name: Run Tests
 
 on: [pull_request]
 
+# This workflow only checks out code and runs the test suite; it never
+# writes to the repo or opens PRs/issues, so read-only is sufficient.
+permissions:
+  contents: read
+
 jobs:
 
   build:

README.md

@@ -220,9 +220,9 @@ cd python-tss-sdk
 python -m venv venv
 . venv/bin/activate
 
-# Install dependencies
+# Install dependencies (runtime + test/build tooling)
 python -m pip install --upgrade pip
-pip install -r requirements.txt
+pip install -r requirements-dev.txt
 ```
 
 Valid credentials are required to run the unit tests. The credentials should be stored in environment variables or in a `.env` file:

SECURITY.md

@@ -0,0 +1,28 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes are released against the latest published version of `python-tss-sdk` on PyPI. We do not backport fixes to older minor/major versions; please upgrade to the latest release to receive security patches.
+
+## Reporting a Vulnerability
+
+If you believe you have found a security vulnerability in this SDK, please report it responsibly through Delinea's coordinated disclosure program rather than opening a public GitHub issue:
+
+- **Trust Portal (preferred):** <https://trust.delinea.com/>
+- **Email:** <security@delinea.com>
+
+Please include:
+
+- A description of the vulnerability and its potential impact.
+- Steps to reproduce, including a minimal code sample against this SDK if applicable.
+- The SDK version (`delinea.__version__`) and Python version in use.
+
+Do not include real credentials, tokens, or secret values from a live Secret Server/Platform tenant in a report.
+
+## What to Expect
+
+Delinea's security team acknowledges and triages reports submitted through the channels above; response times and disclosure timelines are governed by the program terms published at <https://trust.delinea.com/>. Please do not disclose a suspected vulnerability publicly until it has been addressed.
+
+## Scope
+
+This policy covers the SDK code in this repository (`delinea/secrets/server.py` and related packaging). Vulnerabilities in Secret Server, Delinea Platform, or other Delinea products should be reported through the same channels above, which will route them to the appropriate team.