uae-control-map is an offline analysis tool. It reads SARIF files and bundled JSON/YAML data, and writes reports. It opens no network connections at runtime, requires no credentials, and executes nothing from its inputs.

The realistic risk surface is therefore small but not empty:

• Untrusted SARIF parsing. parse_sarif reads scanner output that may come from an untrusted repository. A crash, unbounded memory use, or path traversal via a crafted artifactLocation would be a genuine bug.
• Data integrity. A defect that causes a wrong control reference, a corrupted catalogue that still passes validation, or a rationale quoting text that is not in the standard. This is the failure mode that matters most for this project — it produces confidently wrong compliance output.
• Supply chain. The wheel bundles data files; a tampered artefact would silently change every report.

Report suspected vulnerabilities through GitHub's private reporting:

Open a private security advisory

Please do not open a public issue for anything you believe is exploitable. Include the affected version or commit, a reproduction (a minimal SARIF file is ideal), and what you believe the impact is.

Expect an acknowledgement within 7 days. This is a single-maintainer project, so please allow reasonable time for a fix before disclosing publicly. I will credit you in the advisory unless you would rather stay anonymous.

A wrong control mapping, a mis-parsed crosswalk, or a quote that does not appear in the source is a correctness bug — open a normal public issue for those. They are taken seriously: scripts/validate_mappings.py and scripts/validate_adhics.py exist specifically to make that class of defect detectable — run both before reporting, and include their output.

The source PDFs are not vendored, so the data artefacts are the thing worth verifying. SOURCES.md records each document's URL and sha256, and both extractors are deterministic — regenerating a catalogue from the same PDF produces a byte-identical file:

python scripts/extract_uae_ia.py sources/text/uae-ia-v2.bbox.xhtml /tmp/check.json
diff /tmp/check.json data/uae_ia_v21.json && echo "catalogue unmodified"

The project is pre-1.0. Only the latest commit on main is supported; fixes are not backported.