Security Scanning

Why Mandatory Scanning?

InstallHub packages contain executable workflow logic, AI agent configurations, and business rules. A malicious or compromised package could exfiltrate data, corrupt tenant state, or introduce injection vulnerabilities into running processes. Scanning provides a defense-in-depth layer that operates independently of the package publisher's intentions.

When Scanning Runs

Checks Performed

IPackageSecurityScanner Interface

public interface IPackageSecurityScanner
{
    Task<ScanReport> ScanAsync(
        PackageBundle        bundle,
        ScanContext          context,
        CancellationToken    cancellationToken = default);
}

public record ScanReport
{
    public ScanResult          OverallResult  { get; init; }  // Pass, Warn, Fail
    public IReadOnlyList<ScanFinding> Findings { get; init; }
    public DateTimeOffset      ScannedAt      { get; init; }
    public long                DurationMs     { get; init; }
}

public record ScanFinding
{
    public string   Check         { get; init; }
    public Severity Severity      { get; init; }  // Critical, High, Medium, Low
    public string   ArtifactType  { get; init; }
    public string   ArtifactName  { get; init; }
    public string   Field         { get; init; }
    public string   Value         { get; init; }
    public string   Rule          { get; init; }
    public string   Message       { get; init; }
}

public enum ScanResult { Pass, Warn, Fail }

Result Summary