htr-guard & htr-site — Memory-Safe Coordinated Vulnerability Disclosure (CVD) Engine

License: MIT (SPDX-License-Identifier: MIT)
Repository: https://git.hacker.tr/vahap/htr-guard
Live Deployment: https://hacker.tr
Maintainer: Vahap Eren (vahap@hacker.tr) · OpenPGP 57DB BB2A FF1C B754 E9BF C5C5 44CF 7758 88CF 2883

htr-guard is an open-source, zero-dependency, memory-safe Coordinated Vulnerability Disclosure (CVD) build gate and static advisory publishing engine written in Rust (#![forbid(unsafe_code)]) and Go (standard library only).

It is designed for independent vulnerability researchers, open-source project PSIRTs, and defensive security labs who want to publish permanent, verifiable security advisories (HTR-YYYY-NNN / CVE-YYYY-NNNNN) without risking accidental pre-patch leaks of affected product names, versions, unassigned CVE identifiers, or proof-of-concept exploit details, and without exposing any dynamic server attack surface.

---

Why This Exists

Publishing coordinated security advisories safely has two recurring failure modes:

1. Accidental Pre-Patch Metadata Leakage: Static site generators typically render Markdown files directly; a single forgotten front-matter field or summary line can leak an unpatched vendor/product name or an unassigned CVE ID before a fix ships.
2. CMS & Client-Side Attack Surface: Hosting security advisories on dynamic panels, databases, web forms, or third-party JavaScript bundles creates an unnecessary attack surface on the researcher's own infrastructure.

htr-guard solves both at build time through a fail-closed Rust security gate paired with a zero-JavaScript multi-language Go renderer.

---

Architecture

1. rust-guard/ — htr-guard (#![forbid(unsafe_code)], 0 external crates)

• Fail-Closed Staged Disclosure Redaction (htr-guard gate):
  • reported / cve_requested: Strips product, affected_versions, severity, cvss, timeline, and the Markdown advisory body in memory before rendering. Aborts the build (exit 1) if an unassigned cve_id is present or if internal_vendor / internal_product substrings leak into any public vulnerability class field.
  • cve_reserved: Permits only a syntactically valid assigned CVE-YYYY-NNNN+ identifier while keeping vendor, product, version, and technical PoC details stripped until remediation.
  • published: Validates mandatory publication metadata (published_date, product, affected_versions, severity) and emits full localized technical advisories.
• Static Output Security Auditor & FIPS 180-4 SHA-256 Sealer (htr-guard seal):
  • Parses every generated .html file in dist/ and aborts deployment if any <form>, <input>, <textarea>, <iframe>, <object>, <embed>, inline style="" attribute (enforcing strict Content-Security-Policy: default-src 'none'; style-src 'self'), third-party font/CDN/analytics reference, or executable <script> tag is present (allowing solely <script type="application/ld+json">).
  • Verifies RFC 9116 compliance on /.well-known/security.txt.
  • Computes a pure-Rust FIPS 180-4 SHA-256 manifest (SHA256SUMS.txt) over every output artifact prior to OpenPGP clearsigning.

2. go-site/ — htr-site (Go html/template, 0 external modules)

• Consumes only the sanitized JSON bundle emitted by htr-guard gate—never raw unredacted advisory Markdown.
• Renders 8 canonical pages across 9 languages (en, fr, de, tr, pt, it, ru, zh, es) with full hreflang + x-default cross-linking, content-hashed CSS (/assets/style.<sha256>.css), Schema.org JSON-LD (ProfilePage, BreadcrumbList, TechArticle), localized Atom XML feeds, sitemap.xml, /pgp.asc, and RFC 9116 /.well-known/security.txt.
• Pairs with static OpenPGP Web Key Directory (WKD) export (/.well-known/openpgpkey/hu/...) in deploy/rebuild.sh so mail clients (gpg --locate-external-keys, Thunderbird, ProtonMail) automatically discover encryption keys over HTTPS.

---

Quick Start & Running Tests

Prerequisites

• Rust toolchain (rustc / cargo >= 1.75)
• Go toolchain (go >= 1.22)
• Optional: gnupg (gpg) for RFC 9116 security.txt clearsigning, SHA256SUMS.txt signing, and OpenPGP WKD export

Run the Rust Redaction & Security Gate Unit Tests

cargo test --manifest-path rust-guard/Cargo.toml

Build & Render Locally

# 1. Build binaries
cargo build --release --manifest-path rust-guard/Cargo.toml
(cd go-site && go build -trimpath -ldflags="-s -w" -o ../htr-site .)

# 2. Run fail-closed redaction gate -> sanitized JSON bundle
./rust-guard/target/release/htr-guard gate ./content /tmp/bundle.json

# 3. Render multi-language static output
./htr-site /tmp/bundle.json /tmp/dist

# 4. Audit HTML output (CSP / zero-JS / zero-form) & generate SHA-256 manifest
./rust-guard/target/release/htr-guard seal /tmp/dist /tmp/dist/SHA256SUMS.txt

---

Supporting Open-Source Security Research

All vulnerability disclosures to open-source maintainers and software vendors are performed 100% free of charge under a 90-day Coordinated Vulnerability Disclosure policy (https://hacker.tr/disclosure/).

Community funding for local laboratory hardware (offline vulnerability pattern model training and memory-safety fuzzing without external cloud code leakage) is managed transparently through Open Collective (https://opencollective.com/hacker-tr) with every hardware invoice published on https://hacker.tr/transparency/.

---

License

Released under the MIT License.