Release security observatory · v0.7.2

Know what your forge's security posture actually says.

VersionSec reviews one Gitea or Forgejo instance you own or are explicitly authorized to assess. It reads; it never changes anything. Configuration review and Actions runner review run fully offline, with no network requests at all.

  • read-only
  • one authorized target
  • deterministic
  • Gitea and Forgejo
  • MD / JSON / SARIF
Install from PyPI See what it checks

Apache-2.0 - no account, no hosted control plane, no telemetry.

versionsecread-only
$ versionsec scan \
  --url https://git.example.com \
  --authorized --product gitea \
  --format md,json,sarif

FG-VER          PASS   1.27.3 confirmed
FG-CVE-27771    PASS   fixed in this version
FG-ANON         WARN   anonymous API reachable
FG-REG          PASS   OCI root requires auth
FG-SIGNIN       WARN   repo browser is public

# 22 stable IDs · md + json + sarif written
current release
v0.7.2
checks
22 stable IDs
tests
433 passing
provenance
signed attestation
license
Apache-2.0

Posture questions that usually get answered from memory

Most self-hosted forges are configured once and then trusted indefinitely. VersionSec turns four recurring questions into evidence you can keep, diff and hand to an auditor.

Is the running version actually affected?

Version posture is evaluated against named advisories, and an unknown version is reported as unknown - never quietly as a pass.

What can an anonymous visitor reach?

A bounded set of allowlisted paths is requested with GET only, and the exact observed status is what gets reported.

Does the configuration match what we believe?

An anonymized configuration snapshot is reviewed entirely offline, so the instance itself is never touched.

What can a CI job on the runner do to the host?

Privileged mode, Docker socket exposure, host mounts, network mode and credential lifetime are reviewed from a declared snapshot.

Four review modes, one deterministic report

Each mode produces the same report structure, so results stay comparable over time.

Live posture assessment

One target per run, GET requests only, against an explicit allowlist of paths. No writes, no state change, no discovery of other hosts.

  • FG-VER
  • FG-ANON
  • FG-HTTP
  • FG-REG
  • FG-SIGNIN

Advisory version posture

Named advisories evaluated against the operator-confirmed version. Affected, fixed or unknown - stated explicitly.

  • FG-CVE-27771
  • FG-CVE-78433
  • FG-FJ-TEMPLATE-20260910

Offline configuration review

Reviews an anonymized configuration snapshot you supply. Zero network requests, so it is safe on an instance you may not scan live.

  • FG-CONFIG-REGISTRATION
  • FG-CONFIG-SIGNIN
  • FG-CONFIG-PRIVACY
  • FG-CONFIG-MFA

Offline Actions runner review

Reviews one declared runner snapshot against a closed schema. Severity keys off the declared workload trust, not the version alone.

  • FG-RUNNER-PRIVILEGED
  • FG-RUNNER-DOCKER
  • FG-RUNNER-VOLUMES
  • FG-RUNNER-NETWORK

Qualification targets, not blanket support

Gitea and Forgejo have separate providers with their own checks. These are the exact versions the release is tested against - not a promise about every version in either branch.

Provider
Server qualification targets
Runner qualification targets
Gitea
1.26.41.27.3
3.4.2gitea-runner
Forgejo
15.0.816.0.4
13.0.013.1.0forgejo-runner

Other versions usually work, but nothing outside these targets is presented as verified.

How a run works

1

Declare the target

You name one instance and its product, and affirm that you are authorized to assess it.

2

Bounded collection

Only allowlisted paths are requested, GET only. Offline modes read a file you supply and make no requests.

3

Deterministic evaluation

Each check returns PASS, FAIL, WARN, NOT_APPLICABLE or UNKNOWN. Missing evidence is never a PASS.

4

Report and export

Markdown for people, JSON for pipelines, SARIF 2.1.0 for code-scanning tools. Stable IDs throughout.

Evidence and provenance

The published artifacts are the ones CI built. Their provenance is verifiable with a single command, and a corrupted copy is refused.

Verify the download
$ gh attestation verify \
  versionsec-0.7.2-py3-none-any.whl \
  --repo gexiro-global/versionsec

# wheel  sha256
ea7d40357d808ed490113a62b6dae7fe
4af7e655b61c687c77689b4041828f5d
# sdist  sha256
fcbacb335a17d43436c819507fdb968a
12ff0754644ea6ee7e0e73fc5221b79d

Signed build provenance

Both artifacts carry a Sigstore attestation produced by the project's own CI workflow.

Published hashes

SHA-256 for the wheel and the sdist ship with the release and match the attested subjects.

Release-contract tests

Every documented command is executed as a real subprocess against installed console scripts.

Stable identifiers

Finding IDs and report schema identifiers do not change between releases for branding reasons.

Output formats

Markdown

A readable report with the full finding table, intended for humans and for attaching to tickets.

JSON

A stable machine-readable document with a versioned schema identifier for pipelines.

SARIF 2.1.0

Standard static-analysis interchange format, for code-scanning dashboards and CI annotations.

VersionSec was formerly ForgeGuard

Releases up to and including 0.6.0 were published as ForgeGuard and remain available and unchanged. From 0.7.0 the canonical name is VersionSec.

Existing users are not stranded: the forgeguard command and import forgeguard keep working through a compatibility shim that resolves to the same implementation, and FORGEGUARD_TOKEN is still read.

Migration guide

Why FG-* identifiers stay

Finding IDs such as FG-VER and schema identifiers such as forgeguard.assessment.v1 are contract identity, not branding. Renaming them would break existing report pipelines, suppression lists and SARIF baselines, so they are deliberately unchanged.

0.7.0 erratum

In 0.7.0 the command-line version flag was missing, so versionsec --version exited with an unknown-option error. Scanning, configuration review and runner review were not affected. 0.7.1 fixes it and supersedes 0.7.0.

Install

PyPI: Published on PyPI and installable directly. The compatibility bridge <code>forgeguard==0.7.2</code> installs the same implementation for existing users.
install from pypi v0.7.2
$ python -m pip install versionsec==0.7.2

$ versionsec --version
VersionSec 0.7.2

# existing ForgeGuard users
$ python -m pip install forgeguard==0.7.2
first run
$ versionsec providers
$ versionsec checks
$ versionsec config review --snapshot snap.json
$ versionsec runner review --snapshot runner.json

What VersionSec will not do

Use is limited to an instance you own or are explicitly authorized to assess. Legal authority remains the operator's responsibility.

No exploitation, no payloads, no state-changing requests.
No target discovery and no mass scanning - one declared target per run.
No claim that an instance is uncompromised, and no compromise determination.
No security or compliance certification of any kind.

Questions people actually ask

Does it support Gitea and Forgejo equally?
They are separate providers with their own checks and their own qualification targets. Neither is a wrapper around the other.
Does it need network access?
Live assessment does, to the one target you declare. Configuration review and runner review make no network requests at all.
Does it need an admin token?
No. The live assessment is anonymous by design; a token is optional and only used where the operator explicitly supplies one.
Will it change anything on my instance?
No. Live assessment issues GET requests only, against an allowlist of paths.
What happens if a check cannot be evaluated?
It is reported as UNKNOWN or NOT_APPLICABLE. Missing evidence is never reported as a pass.
Is a version outside the qualification targets unsupported?
It usually works, but only the listed targets are tested, so only those are presented as verified.
I already use ForgeGuard. What breaks?
Nothing. The command, the import path, the environment variable and every FG-* finding ID keep working.
What license is it under?
Apache-2.0. The full source, the release artifacts and the test suite are public.

Contact

For questions about the tool, integration work, or a scoped hardening review. Pick the topic so it reaches the right place.

Reporting a vulnerability in VersionSec itself? Use the security policy in the repository so the report follows the documented disclosure route. Security policy.