---
url: /docs/security/threat-model.md
description: >-
  Threats, assets, trust boundaries, and mitigations for the Task project and
  its release infrastructure
---

# Threat Model

This document outlines the security threats, assets, and mitigations for the
Task project. It serves as a high-level, public guide and is published as part
of our commitment to transparency.

## Asset Inventory

### Critical Assets

* **Source Code:** The Task CLI, build scripts, and configuration files (e.g.,
  `Taskfile.yml`, `.goreleaser.yml`).
* **Build Artifacts:** Compiled binaries, packages, and containers distributed
  to users.
* **Secrets:** API tokens, signing keys, and repository credentials used in
  CI/CD and release pipelines.
* **Release Metadata:** Version numbers, changelogs, and checksums.
* **CI/CD Pipelines & Runners:** GitHub Actions workflows that build, test, and
  release the project.
* **Third-party Dependencies:** Go modules and tools used to build and
  distribute Task.
* **Website & Documentation:** The taskfile.dev site and installation scripts.

### Asset Locations

* Local developer machines
* GitHub Actions runners
* GitHub Releases
* Public package registries (npm, Homebrew, Winget, Cloudsmith)
* Source control platforms (GitHub)
* Netlify (website hosting)

## Threat Model

### Actors

* **Maintainers & Contributors:** Trusted users with varying levels of
  repository access.
* **External Attackers:** Untrusted users seeking to compromise builds,
  releases, or user systems.
* **Supply Chain Threats:** Malicious dependencies or compromised third-party
  services.
* **CI/CD Systems:** Automated agents that may be exploited if misconfigured.

### Entry Points

* Source code contributions (pull requests, issues)
* Configuration files and build scripts
* CI/CD integration and environment variables
* Third-party dependencies
* Release pipelines and artifact repositories
* Remote Taskfile fetching (HTTP, Git)
* Installation scripts

### Trust Boundaries

* Between the project repository and the CI/CD environment
* Between Task and remote Taskfiles fetched over the network
* Between artifact generation and distribution channels
* Between the Task binary and user-defined shell commands

### Threats

#### Supply Chain Attacks

* Compromised Go dependencies or build tools
* Unauthorized changes to source code or configuration
* Exploitation of third-party CI/CD or package registry services
* Compromised installation scripts or distribution channels

#### Secrets Leakage

* Exposure of tokens, credentials, or signing keys in logs, error messages, or
  artifacts
* Hardcoded secrets in code or configuration
* Improper secret management in CI/CD environments

#### Code Execution / Injection

* Malicious code execution via compromised pull requests or dependencies
* Remote code execution vulnerabilities in Task or its dependencies
* **Note:** Task intentionally executes user-defined shell commands as part of
  its core functionality. Users are responsible for the commands they define in
  their Taskfiles.

#### Unauthorized Access

* Unauthorized users triggering releases or accessing sensitive artifacts
* Insecure permissions on runners, repositories, or artifact stores
* Compromised maintainer accounts

#### Data Integrity & Tampering

* Tampering with build artifacts, changelogs, or metadata
* Compromise of signing keys, leading to malicious releases
* Man-in-the-middle attacks against remote Taskfile fetching

#### Denial of Service

* Abuse of CI/CD resources, bandwidth, or artifact storage
* Overloading automated processes or API endpoints
* Malicious Taskfiles designed to exhaust system resources

## Mitigations

### Supply Chain Security

* Pin dependencies and use trusted sources
* Mandatory code review and CI checks on all incoming pull requests
* Signed commits and release tags
* Enable immutable releases where supported
* Run `govulncheck` on every commit and tag
* Pin GitHub Actions to specific commit SHAs

### Secrets Management

* Secure storage using GitHub Secrets
* Never log or expose secrets in build or release outputs
* Regularly rotate secrets and monitor for suspicious activity
* Use least-privilege tokens scoped to specific repositories

### Secure Code Execution

* Validate and sanitize configuration files and user inputs
* Audit dependencies for vulnerabilities
* HTTP is rejected for remote Taskfiles by default (requires `--insecure` flag)
* TLS certificate verification for remote Git repositories

### Access Control

* Enforce least privilege for CI/CD runners, repositories, and artifact stores
* Require multi-factor authentication for maintainers
* Restrict release triggers to tagged releases only
* Lower permissions of less active maintainers

### Artifact Integrity

* Generate checksums for all release artifacts
* Distribute artifacts via trusted, access-controlled repositories
* Verify signatures and checksums in installation scripts where possible

### Availability Protection

* Implement rate limiting and resource quotas on CI/CD jobs
* Monitor for abnormal activity and automate alerts
* Set timeouts on network operations (e.g., remote Taskfile fetching)

## Residual Risks

* Zero-day vulnerabilities in dependencies, CI/CD systems, or Task itself
* Social engineering attacks targeting maintainers
* Unnoticed supply chain compromises
* Human error in configuration or secret management
* Users fetching malicious remote Taskfiles from untrusted sources

## Security Best Practices

* Regularly update dependencies and build tools
* Monitor security advisories and patch vulnerabilities promptly
* Educate contributors on secure coding and secrets hygiene
* Document security policies and incident response procedures

## References

* [Task Documentation](https://taskfile.dev/)
* [Incident Response Plan](/docs/security/incident-response-plan.md)
* [OWASP Top 10](https://owasp.org/www-project-top-ten/)
* [Supply Chain Security](https://slsa.dev/)
* [GitHub Security Best Practices](https://docs.github.com/en/code-security)