Risk Matrix¶

This document consolidates the risks of the Quorum project (quorum-sec-scan, v0.8.3) — a CLI/Docker consensus security scanning tool — organized by category (Technical, Business, Security, Operations, Infrastructure, Financial, Legal, plus the opt-in Advisory/AI layer). For each risk there is an ID, description, probability, impact, severity (computed by matrix), mitigation, owner and status. The focus is on risks that are real and verifiable in the code: dependency on the versions/outputs of the 12 external scanners, supply chain, OSV.dev unavailability, partial coverage of the consensus crosswalk, false negatives from wrong mount/config, aging of the Grype database, resource exhaustion (DoS), maintenance bus factor of OSS, and — only when the opt-in advisory layer is enabled — AI-specific risks.

Code references verified for this document: README.md, DESIGN.md (§6 correlation, §7 alias, §8 crosswalk, §9 consensus, §12 supply chain, §14 risks), internal/orchestrator/orchestrator.go, internal/adapter/ (12 adapters), internal/alias/osv.go, cmd/quorum/scan.go, internal/advisor//internal/enrich//internal/rag/ (advisory layer), crosswalk/aws.yaml/azure.yaml/gcp.yaml/k8s.yaml, action.yml, Dockerfile.full, .goreleaser.yaml, .github/workflows/release.yml, .github/workflows/tag-major.yml. Internal cross-link: 01 — Overview.

Scope (explicit N/A). Quorum is CLI/Docker only: there is no web frontend, relational database, HTTP REST API, or authentication/user accounts. The deterministic core has no AI; an opt-in advisory layer (--advice) adds a local/remote LLM presentation layer that is off by default and never touches correlationKey/fingerprint/confidence/aggregated severity/the fail-on gate (without --advice, output is byte-identical). Because of this, whole classes of risk typical of server-side applications — injection in HTTP endpoints, PII leakage from a database, session/authentication compromise, service DDoS, runtime cloud cost — are treated as N/A with a technical rationale (see §10 N/A Risks). The cataloged risks reflect the as-is architecture: a stateless orchestrator that shells out to OSS scanners and runs in CI/CD pipelines.

1. Methodology¶

1.1 Scales¶

Probability (P) — chance the risk materializes over a ~12-month operating horizon:

Level	Label	Criterion
1	Rare	Unlikely; depends on an uncommon external event
2	Low	Can occur, but not expected
3	Medium	Plausible within the normal usage cycle
4	High	Expected to occur at least once
5	Almost certain	Recurring / continuous by nature

Impact (I) — consequence should the risk materialize:

Level	Label	Criterion
1	Insignificant	Cosmetic; no effect on the scan result
2	Minor	Localized degradation; workaround-able
3	Moderate	Partial failure; less trustworthy result, but detectable
4	Severe	Silent false negative or incorrect CI gate
5	Critical	Supply chain compromise / wrong security decision in production

1.2 Severity (P × I matrix)¶

Severity is the product P × I, classified into bands:

Band (P×I)	Severity	Expected action
1–4	🟢 Low	Accept / monitor
5–9	🟡 Medium	Mitigate when feasible; review periodically
10–14	🟠 High	Active mitigation required; named owner
15–25	🔴 Critical	Priority mitigation; blocks "production-ready"

1.3 Heatmap (textual)¶

Each cell lists the risk IDs whose (P, I) combination falls there. See the catalog in sections 2–9.

            IMPACT →
            1(Insig)   2(Minor)      3(Moder)           4(Severe)          5(Critical)
P  5 ┃        ·          ·             T-01               T-02,O-01          ·
R  4 ┃        ·          T-06,T-07     S-03,O-02          T-03,T-04,S-04     S-01
O  3 ┃        ·          N-02,A-01     T-05,N-01,S-05     S-02,I-01,O-03     L-01
B  2 ┃        ·          F-02,A-04     L-02,I-02,A-03     F-01,I-03,A-02,A-05  ·
.  1 ┃        ·          ·             ·                  N-03               ·
     ┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
      Severity legend:  🟢 low(≤4)  🟡 medium(5–9)  🟠 high(10–14)  🔴 critical(≥15)

quadrantChart
    title Risk — Probability x Impact
    x-axis "Low impact" --> "High impact"
    y-axis "Low prob." --> "High prob."
    quadrant-1 "Critical (mitigate now)"
    quadrant-2 "Monitor prob."
    quadrant-3 "Accept / monitor"
    quadrant-4 "Mitigate impact"
    "T-02 scanner output": [0.78, 0.92]
    "T-03 partial crosswalk": [0.80, 0.80]
    "T-04 false MISCONFIG merge": [0.78, 0.80]
    "S-01 scanner supply chain": [0.95, 0.80]
    "S-04 wrong mount": [0.80, 0.78]
    "S-05 stale grype DB": [0.62, 0.62]
    "T-07 DoS huge output/target": [0.55, 0.40]
    "O-01 0 findings = safe": [0.92, 0.95]
    "S-02 skipping signature check": [0.62, 0.60]
    "T-01 OSV unavailable": [0.55, 0.90]
    "I-03 GHCR/Actions outage": [0.78, 0.35]
    "L-01 OSS bus factor": [0.62, 0.58]
    "A-02 remote egress leak": [0.65, 0.30]
    "A-01 hallucinated advice": [0.40, 0.35]

2. Technical Risks¶

Related to product correctness, dependency on the output of the 12 scanners (trivy, grype, checkov, kics, dockle, kubescape, polaris, kube-score, terrascan, tfsec, regula, conftest), correlation and consensus.

ID	Description	P	I	Sev	Mitigation	Owner	Status
T-01	OSV.dev unavailable or slow during alias resolution (CVE↔GHSA). Without resolution, the same bug reported as `GHSA-…` (Grype) and `CVE-…` (Trivy) may become two findings and break VULN consensus.	3	5	🟠 15→High (band cap)	Graceful degradation already implemented (`DESIGN.md` §7): network failure ⇒ uses the id as-is, never brings down the scan. Local cache (`~/.cache/quorum/aliases.json`, perm `0600` + `schemaVersion`) reduces dependency. `--offline` disables OSV deterministically. Finding-local aliases (Grype `relatedVulnerabilities`) cover part of the cases without network. Id validated and `url.PathEscape` on the call (`osv.go`).	Core / Alias	Mitigated (residual: VULN under-merge under poor network)
T-02	Change in an external scanner's output format (any of the 12 changes JSON/SARIF between versions), breaking the adapter parser and producing missing or malformed findings. Central residual risk of the product.	5	4	🔴 20 Critical	Contract test per adapter against versioned fixtures of the real output (`internal/adapter/testdata`, `realdata_test.go`, `DESIGN.md` §5); the test breaks before production. Scanner version pinning by `@sha256` in the `:full` image (`Dockerfile.full`). Refresh fixtures on every version bump. Test coverage required in CI.	Adapters	Mitigated (CI detection)
T-03	Partial coverage of the consensus crosswalk. The mappings in `crosswalk/{aws,azure,gcp,k8s}.yaml` were derived from real scanner output (no longer illustrative), but cover a subset of controls (AWS S3/IAM/EBS/SG/RDS/KMS/CloudTrail/VPC-flow-logs; Azure Storage/Key Vault; GCP bucket/firewall/SQL; K8s C-#### from kubescape × polaris × kube-score). A control outside the map remains isolated (no consensus), not wrong.	4	4	🔴 16 Critical	"When in doubt, don't merge" rule: an unmapped control stays `unmapped`, never guessed (false split > false merge, `DESIGN.md` §6) — the failure is safe. Mappings with real IDs (Trivy-native AVD, KICS UUIDs, kubescape C-####) semantically checked against output. `tfsec` auto-correlates with `trivy` (emits native AVD). Pluggable crosswalk via `--crosswalk`. K8s RBAC stays single-engine (kubescape RBAC requires cluster context) — documented.	Crosswalk / Content	Partially mitigated (expand coverage for prod)
T-04	*False merge* (over-merge) in MISCONFIG.** By a known limitation, MISCONFIG correlates by `basename(file) + resourceType + canonicalControl`; two distinct resources of the same type with the same control in the same file may merge (`README.md` "Known limitations").	4	4	🔴 16 Critical	The false split > false merge design principle mitigates the inverse (does not merge by default), but this specific case is an accepted and documented trade-off. Per-resource identity tracked for a future release.	Core / Correlate	Open (documented limitation)
T-05	Miscalibrated confidence (`confidence`). The formula weights number of engines (log), category diversity, severity and authoritative confirmation (`DESIGN.md` §9); fixed weights may prioritize poorly in specific domains, now with more engines contributing per finding.	3	3	🟡 9 Medium	Deterministic and auditable score; `detectedBy`/`detectionCount` exposed in the report for the human to re-assess. Raw count is deliberately not confidence. Versionable weights.	Consensus	Monitor
T-06	*Per-scanner timeout / version probe* poorly sized.** Default probe 60s (`defaultProbeTime`) and `--timeout` 5m; with 12 scanners in the fan-out, on a slow/saturated runner a healthy scanner may be marked `unavailable`/`timeout`.	4	2	🟡 8 Medium	Generous probe (60s) and distinguishes timeout/killed(OOM)/not-installed with actionable messages (`orchestrator.go`, `runOne`). `ProbeTime`/`PerScannerTime` configurable; `--scanners` scopes the pool. Status always reported (transparency).	Orchestrator	Mitigated
T-07	Memory exhaustion from huge output or target (DoS). A scanner dumping an outsized JSON/SARIF, or a very large target (repo/manifest), could blow up process/runner RAM in the parallel fan-out.	4	2	🟡 8 Medium	DoS caps already implemented: output read capped at `QUORUM_MAX_OUTPUT_BYTES` (default 512 MiB, aborts with an actionable error instead of OOM — `adapter.go`) and on-disk target size capped at `QUORUM_MAX_TARGET_BYTES` (default 20 GiB — `scan.go`). Both adjustable/disable-able via env.	Adapters / Orchestrator	Mitigated

3. Business Risks¶

ID	Description	P	I	Sev	Mitigation	Owner	Status
N-01	Value proposition not understood ("it's just another scanner wrapper"). The differentiator is the correlation + consensus layer (now active in SCA and MISCONFIG/K8s via crosswalk), not detection.	3	3	🟡 9 Medium	Clear positioning in the docs: "not just another scanner" (`README.md`, 01 — Overview). `detectionCount`/`confidence` example at the top of the README. Docs published on GitHub Pages (MkDocs Material).	Product / Docs	Mitigated
N-02	Low adoption due to installation friction of multiple scanners (now 12).	3	2	🟡 6 Medium	Self-contained `:full` image (all 12 scanners bundled) + GitHub Action composite (`uses:`) removes installation. `:slim` mode for those who already have scanners on the PATH.	Distribution	Mitigated
N-03	Competition / overlap with SaaS ASPM platforms.	1	4	🟢 4 Low	Deliberate niche: lightweight, pluggable, CLI/Docker, no lock-in, no dashboard/daemon. Complements (produces SARIF for GitHub code scanning / DefectDojo) rather than competing.	Product	Accept

4. Security Risks¶

ID	Description	P	I	Sev	Mitigation	Owner	Status
S-01	Supply chain compromise via scanner binaries embedded in the `:full` image. The 12 binaries are part of the user's trust boundary; there was a supply-chain incident in scanner Actions in 2026 (`DESIGN.md` §12).	4	5	🔴 20 Critical	Hardened in code: each tool is now obtained via verified checksum/`@sha256` at build (`trivy`/`kics` by image digest; `dockle`/`kubescape`/`polaris`/`kube-score`/`tfsec`/`terrascan`/`regula`/`conftest` via `sha256sum -c`; grype/syft via checksum-verified official installers) and base images pinned by sha256 (`Dockerfile.full`). Quorum images/binaries signed keyless with cosign (OIDC, with retry) + SLSA build-provenance attestation and attested SPDX SBOM (`actions/attest-build-provenance`, `actions/attest-sbom`, BuildKit `sbom:true`), verified end-to-end within the release itself (`release.yml`, `.goreleaser.yaml`). The knowledge pack + crosswalk get their own SLSA build-provenance attestation each release (`knowledge` job). Composite Action cosign-verifies the image before running (`action.yml`).	Supply chain / Release	Mitigated (residual: trust in the scanner publishers)
S-02	User does not verify the signature/attestation before running the image/binary, accepting a tampered artifact.	3	4	🟠 12 High	`cosign verify`, `gh attestation verify` (images, binaries and knowledge pack) documented in the README; the moving `v0` tag (auto-advanced by `tag-major.yml`) recommends pinning by `@<sha>` in production. Default verification in the composite Action.	Docs / Release	Mitigated (action left to the user)
S-03	Secret leakage via the `Raw`/`Match` field (scanner payload preserved in the `Finding`) if the output includes detected secrets (Trivy `TypeSecret`).	4	3	🟠 12→Medium (residual)	Redaction implemented: Trivy's `Match` is never stored in clear — only a redacted snippet is kept (`redactSecretText`, `trivy.go`). `--min-severity`/baseline filter; the report is a user-controlled artifact (CLI/Docker, no automatic upload). Still treat SARIF/JSON artifacts as sensitive in pipelines.	Core / Docs	Mitigated (redaction in code)
S-04	*Malformed bind mount* ⇒ false negative. `-v "%cd%/work"` (without `:`) mounts an empty `/work` and reports 0 findings** for everything — a false negative, not a security attestation (`README.md`).	4	4	🔴 16 Critical	Explicit warning and per-shell examples (cmd/PowerShell/bash) in the README. Per-scanner status (`ran`/`skipped`/`unavailable`) and the motto "0 findings is not proof of safety" help detect it. In the Action, `--type image` auto-mounts `/var/run/docker.sock` (avoids false-zero on local image scan) and warns when the socket is absent (`action.yml`).	Docs / Orchestrator	Partially mitigated (indirect detection)
S-05	Grype vulnerability database aging. The `:full` image ships the grype DB pre-cached; without an update, recent CVEs stop being detected (false negative).	3	3	🟡 9 Medium	DB pre-cached with `GRYPE_DB_VALIDATE_AGE=false` (does not expire ⇒ does not fail the scan by age, guarantees offline/deterministic — `Dockerfile.full`). In a networked environment, Grype can update the DB. Residual: fixed DB becomes stale — rebuild/republish `:full` periodically and document the packaged DB date.	Release / Distribution	Mitigated (residual: rebuild cadence TBD)

5. Operations Risks¶

ID	Description	P	I	Sev	Mitigation	Owner	Status
O-01	"0 findings" interpreted as "it's secure" when in fact no scanner ran (absent, OOM, timeout, wrong target).	5	4	🔴 20 Critical	Central to the product: per-scanner status in every report and the motto "0 findings is not proof of safety" (`orchestrator.go` `ScannerRun`, `DESIGN.md` §14). Summary on stderr; `--log-format text\\|json` and optional Prometheus metrics (`--metrics`) give observability in CI.	Orchestrator / Docs	Mitigated
O-02	Scanner absent in `:slim` mode (orchestrator calls scanners from the PATH) ⇒ silently reduced coverage, now with 12 possible scanners.	4	3	🟠 12 High	An absent scanner becomes `unavailable` and is skipped — the scan never fails just because of that, but the status is reported. `list-scanners` shows the registered ones. The `:full` image avoids the problem. `conftest` with no policy in `./policy` is reported as `error` (policy-as-code is opt-in).	Orchestrator	Mitigated
O-03	Wrong gate configuration (`--fail-on`/`--min-severity`) lets real risk through or blocks builds unduly; exit-code confusion (`1` gate vs `2` error).	3	4	🟠 12 High	Exit codes documented (`0` ok / `1` gate / `2` error). `.quorumignore` baseline by fingerprint with suppressions always logged. Ready-made CI examples in `examples/ci/`.	Docs / CLI	Mitigated

6. Infrastructure Risks¶

ID	Description	P	I	Sev	Mitigation	Owner	Status
I-01	*OOM / runner* out of memory** kills the probe or the scanner (12 potentially heavy scanners launched in parallel in the fan-out).	3	4	🟠 12 High	`killedSignal` detects `signal: killed` and emits an actionable message ("likely OOM — increase container memory") (`orchestrator.go`). `--scanners` allows scoping the pool. DoS caps (T-07) prevent OOM from huge output/target. Generous 60s probe.	Orchestrator / Infra	Mitigated
I-02	`:full` is `linux/amd64` only (no arm64); arm users need `:slim` (amd64+arm64) or a native binary.	2	3	🟡 6 Medium	Documented trade-off: `:full` amd64 (all 12 scanners), `:slim` multiarch (`README.md` tag table). Native binaries via GoReleaser for several platforms.	Distribution	Accept (documented)
I-03	GHCR / GitHub Actions unavailability affects release and image pull; dependency on third-party infrastructure.	2	4	🟡 8 Medium	Images are cacheable; native binaries as an alternative distribution. CI/CD via PR to `main`; release by restricted semver tag (`v[0-9]+.[0-9]+.[0-9]+`). Residual risk since it is an external platform.	Release / Infra	Accept (platform dependency)

7. Financial Risks¶

Quorum is OSS, CLI/Docker, with no persistent service nor its own runtime cloud, which drastically limits financial exposure (no production infra cost, no usage-based billing).

ID	Description	P	I	Sev	Mitigation	Owner	Status
F-01	CI-minute / package-storage cost at the provider (GitHub Actions/GHCR) grows with the build matrix (multi-arch, 12 scanners, SLSA/SBOM attestations including the knowledge pack).	2	4	🟡 8 Medium	Release triggered only by semver tag (not on every push); `:full` restricted to amd64 reduces the matrix; build caches; grype DB pre-cached.	Release / Infra	Mitigate
F-02	Maintenance cost / maintainer time (effort, not direct outlay) to track versions of 12 scanners + crosswalk + knowledge pack.	2	2	🟢 4 Low	Pluggable adapters (isolate change); contract tests; incremental crosswalk derived from real output; evals harness (`internal/evals`) keeps advisory data honest in CI. Related to L-01 (bus factor).	Maintenance	Monitor

8. Legal Risks¶

ID	Description	P	I	Sev	Mitigation	Owner	Status
L-01	Bus factor / sustainability of OSS maintenance. Dependency on few maintainers and on 12 external OSS projects — some in reduced maintenance or archived (e.g. `tfsec` absorbed by Trivy but still bundled; `terrascan` archived in Nov/2025 but packaged, `DESIGN.md` §2).	3	5	🔴 15 Critical	Pluggable adapters architecture: swapping a dead scanner = swapping one adapter, without touching the core (`DESIGN.md` §1). `tfsec` auto-correlates with `trivy` (native AVD), reducing the impact of its discontinuation. Scope deliberately excludes redundant tools with no consensus value. External contributions enabled by the stable interface.	Maintenance / Community	Open (structural OSS risk)
L-02	License compliance of the embedded binaries in the `:full` image (each of the 12 distributed scanners has its own license).	2	3	🟡 6 Medium	`THIRD_PARTY_NOTICES.md` catalogs the redistributed third-party licenses; audit each binary's license distributed in the image (`DESIGN.md` §14). Project under Apache-2.0; `:slim` does not redistribute third-party binaries.	Legal / Release	Partially mitigated (continuous audit recommended)

9. Advisory (AI) Layer Risks — opt-in only¶

These risks only apply when the advisory layer is enabled via --advice. The layer is off by default, is presentation-only, and never touches correlationKey/fingerprint/confidence/aggregated severity/the fail-on gate — without --advice the output is byte-identical and none of these risks apply. The deterministic core has no AI. Phase 0 (curated remediation templates + OWASP references, internal/enrich) and Phase 2 (RAG from a digest-pinned OWASP corpus, internal/rag) are deterministic and use no model by default; Phase 1 (local LLM) and Phase 3 (remote provider) are the model-backed, opt-in phases (internal/advisor).

ID	Description	P	I	Sev	Mitigation	Owner	Status
A-01	Hallucinated / incorrect natural-language advice from the LLM (`--advice-provider=local\\|remote`) — a wrong remediation recommendation misleads the user.	3	2	🟡 6 Medium	Presentation-only: advice never changes correlation/consensus/severity/gate; the deterministic result stands alone. Every AI attachment is labeled "AI-generated, advisory only" (`internal/advisor`). Deterministic Phase 0 templates + OWASP references are preferred and available with no model. `temperature=0` for reproducibility. Off by default.	Advisor	Mitigated (advisory framing)
A-02	Data egress leak via the remote provider (`--advice-provider=remote`): the normalized finding leaves the host to an external API.	2	4	🟡 8 Medium	Explicit consent gate `--advice-allow-egress` required; BLOCKED by `--offline`; only the normalized finding is sent — never source code. Auth via `QUORUM_ADVICE_API_KEY` env (Action forwards it as env, never inline). Local provider (on-host, e.g. Ollama) keeps data on the host. Off by default.	Advisor / Docs	Mitigated (consent + offline-block)
A-03	Bad `--fix=suggest` patch proposes an incorrect or damaging change.	2	3	🟡 6 Medium	Verify-the-fix: the patch is applied to a temp copy, re-scanned with the same scanner, and kept only if the finding is gone and the file still parses (`internal/advisor/verify.go`); it never auto-applies. The remote provider refuses `--fix` (would upload source). `--fix` defaults to `off`. Verify-the-fix rate tracked as an eval and metric.	Advisor	Mitigated (verify-the-fix + never auto-apply)
A-04	Non-reproducibility / non-determinism of model output undermines auditability of the advisory attachment.	2	2	🟢 4 Low	`temperature=0` + an on-disk cache keyed by `fingerprint+provider+model` (`internal/advisor`) make attachments stable. Graceful degradation: if the model is unreachable, the report ships without AI advice and the scan never fails.	Advisor	Mitigated
A-05	Knowledge-pack / OWASP corpus tampering or drift (`knowledge/*.yaml`, `knowledge/owasp/corpus.yaml`) feeds wrong Phase 0/Phase 2 content.	2	4	🟡 8 Medium	Corpus is versioned and DIGEST-PINNED; `quorum advise-index` embeds it preserving the pin. The knowledge pack + crosswalk get a SLSA build-provenance attestation each release (verify with `gh attestation verify knowledge/owasp/corpus.yaml`). Retrieval is deterministic (lexical by default; semantic only when embedded).	Supply chain / Advisor	Mitigated (attestation + pin)

10. N/A Risks (by architecture)¶

Items common in enterprise templates that do not apply to Quorum, with a technical rationale. Where it makes sense, a clearly separated future proposal is noted.

Risk category (template)	Status	Rationale
Injection/OWASP in HTTP endpoints, CSRF, XSS	N/A	There is no web frontend or HTTP REST API. Quorum is a stateless CLI binary / Docker image. (Argument injection in shell-out is handled: a target starting with `-` is refused — `scan.go`.)
PII leakage in a database	N/A	There is no relational database. The only persistent state is the alias cache in `~/.cache/quorum/aliases.json` (public vuln IDs, no PII; perm `0600`) and the advisory cache (redacted attachments keyed by fingerprint).
Authentication/session/account compromise	N/A	There is no authentication or user accounts. Authorization is that of the shell/CI where the binary runs.
Hallucination / prompt injection / AI token cost	N/A for the core; addressed in §9 when the advisory layer is enabled	The deterministic core has no AI — correlation and consensus are pure functions of the normalized data. The opt-in advisory layer (`--advice`, off by default) can invoke a local/remote LLM; its risks (hallucination A-01, egress A-02, bad fix A-03, non-determinism A-04, corpus tampering A-05) are cataloged in §9. The OWASP LLM Top 10 only applies when that layer is enabled.
DDoS / online service availability	N/A	There is no exposed service/daemon. The only outbound call (OSV.dev, and the remote advisor when explicitly enabled) is optional and degrades gracefully. Local resource exhaustion is handled by DoS caps (T-07).
Runtime cloud cost / autoscaling	N/A	No own runtime cloud; runs on the user's CI/host.
Runtime security risk (Falco/Tetragon stream)	N/A today	Stream model out of scope. Future proposal: separate runtime module (roadmap `README.md`/`DESIGN.md` §13).

11. Critical risks — consolidated view¶

flowchart LR
    subgraph criticals["🔴 Critical Severity (≥15)"]
        T02["T-02 scanner output format changes"]
        T03["T-03 crosswalk with partial coverage"]
        T04["T-04 MISCONFIG over-merge"]
        S01["S-01 scanner supply chain"]
        S04["S-04 wrong mount = 0 findings"]
        O01["O-01 '0 findings' = safe"]
        L01["L-01 OSS bus factor"]
    end
    T02 --> contract["Contract tests + versioned fixtures"]
    T03 --> nomatch["No-match rule (unmapped) + real IDs"]
    T04 --> future["Per-resource identity (future)"]
    S01 --> cosign["cosign + SLSA + SBOM + scanners by sha256/checksum"]
    S04 --> status["Per-scanner status + 0!=safe motto + auto-mount socket"]
    O01 --> status
    L01 --> adapters["Pluggable adapters"]

12. Treatment plan (actionable checklist)¶

Prioritized by 🔴/🟠 risks. Items mark what is still missing to consolidate "production-ready". Items already completed in v0.8.3 appear checked.

[ ] T-03 / crosswalk: expand coverage beyond the current subset (more AWS/Azure/GCP services and K8s controls) and revalidate IDs on every scanner bump.
[ ] T-02: keep contract-test coverage for the 12 adapters and review fixtures on every scanner version bump.
[x] S-01: scanner references in :full converted to @sha256:<digest>/verified checksum at build.
[x] S-01: SLSA build-provenance attestation + attested SPDX SBOM (image and per-binary) verified in the release.
[x] S-01: knowledge pack + crosswalk get their own SLSA build-provenance attestation each release.
[ ] S-05: define the :full rebuild/republish cadence and document the packaged grype DB date.
[ ] S-02: reinforce in the README/CI the cosign/SLSA verification (including the knowledge pack) and pinning the Action by @<sha>.
[x] S-03: secrets (Trivy's Match) redacted before storing in the Finding.
[x] A-02/A-03: remote egress gated on --advice-allow-egress, blocked by --offline; --fix refused by the remote provider; verify-the-fix on a temp copy, never auto-applies.
[ ] O-01 / S-04: consider an automatic warning when all scanners ran (ran) but the total finding count is 0 on a non-trivial target.
[ ] L-02: keep the license audit of the binaries redistributed in :full (basis: THIRD_PARTY_NOTICES.md).
[ ] L-01: document the adapter contribution/replacement process to reduce the bus factor.
[ ] T-04: track the implementation of per-resource identity for MISCONFIG.

13. Re-assessment¶

Re-assessment triggers: version bump of any scanner; new image/binary release; change in the OSV.dev schema; archival/discontinuation of an OSS scanner; supply-chain incident; change to the advisory layer (new advice provider, corpus re-pin, model default).
Suggested cadence: review the matrix on every semver release (v[0-9]+.[0-9]+.[0-9]+) and a full audit quarterly.
Document owner: maintainer(s) of quorum-sec-scan.

Assumptions¶

Version. Document aligned to v0.8.3 (revision of 2026-07-04); severities, mitigations and status reflect the code read at the time of writing (README.md, DESIGN.md, internal/orchestrator/orchestrator.go, internal/adapter/, internal/advisor/, cmd/quorum/scan.go, Dockerfile.full, action.yml, .github/workflows/release.yml).
Product scope. Quorum is CLI/Docker only (no web frontend, relational DB, HTTP REST API, or authentication/accounts). The deterministic core has no AI; an opt-in advisory layer (--advice, off by default, presentation-only) is the sole AI surface, and its risks are cataloged in §9. Risks corresponding to the absent components are N/A by architectural decision (see §10).
P/I/severity scales are a convention of this document (5×5 matrix, P×I product bands), not an artifact present in the code. The numeric P and I values are qualitative estimates by the maintainers, not measurements.
Band caps. When P×I exceeds 14, severity is "Critical"; T-01 (15) is presented as High→borderline because it is already mitigated in code (graceful degradation), reflecting the residual risk, not the raw one.
Consensus and crosswalk. Consensus is active in SCA and in MISCONFIG/IaC/K8s; the crosswalk/{aws,azure,gcp,k8s}.yaml mappings were derived from real scanner output (real AVD/CKV/KICS-UUID/C-#### IDs), with coverage still partial (T-03). K8s RBAC stays single-engine (kubescape RBAC requires cluster context) — documented.
Advisory layer is opt-in and off by default. Without --advice, output is byte-identical and no AI risk (§9) applies. When enabled, egress to a remote provider requires explicit consent (--advice-allow-egress) and is blocked by --offline; --fix only keeps a patch that passes a verify-the-fix re-scan and never auto-applies; only the normalized finding is ever sent — never source code.
Owners cited are roles/areas (Core, Adapters, Orchestrator, Crosswalk, Advisor, Release/Distribution, Docs, Maintenance/Community, Legal), not named people — the repository does not define a formal RACI.
Optional network dependency. Alias resolution via OSV.dev is optional; the scan completes without connectivity (--offline disables it). This underpins the "mitigated" status of T-01.
Supply chain as trust boundary. Scanner binaries embedded in :full are part of the user's trust boundary; in v0.8.3 the digest-pin recommendation is applied (@sha256/verified checksum at build — Dockerfile.full), and the knowledge pack + crosswalk are covered by a SLSA build-provenance attestation, leaving as residual the trust in the scanners' original publishers (S-01) and the packaged grype DB date (S-05).