Security

What this package defends

This package formats normalized events into SIEM wire schemas. It does no network I/O, opens no sockets, holds no credentials, and has zero runtime dependencies. Its entire security surface is therefore one thing:

Preventing log/record injection during formatting.

A SIEM record is frequently a single line (CEF/syslog) or a document parsed downstream. If attacker-influenced data — a username, a message, a context field — is written into a record unescaped, it can forge record structure: break out of a field, inject a key, or emit a raw newline that a framer reads as a second, attacker-authored event.

The CEF formatter is the sharp edge and gets a dedicated page and an adversarial test — see Escaping. The JSON-based formatters (JSON, ECS, Splunk HEC, GELF) emit through json_encode, which escapes control characters, including newlines, by construction.

Honest scope — what is NOT here

Everything past a formatted string is out of scope by design and belongs to the Laravel wrapper cboxdk/laravel-siem:

• Egress / SSRF protection on the destination endpoint.
• TLS, authentication, and tokens (HEC keys, API credentials).
• Encrypted secret storage.
• Batching, retries, back-pressure, and dead-letter handling.

The core deliberately treats a Cbox\Siem\ValueObjects\StreamTarget's endpoint as an opaque string it never dials, parses, or validates, precisely so those decisions are made in the layer equipped to make them safely. Do not read an SSRF guarantee into this package — it formats; it does not connect.

Reporting

Report vulnerabilities through GitHub Private Vulnerability Reporting (the repository's Security tab → Report a vulnerability). Please do not open a public issue for a suspected vulnerability. This is a best-effort project — there is no security@ mailbox, PGP key, response SLA, or CVE pipeline; GitHub's advisory workflow is the single supported channel. The full policy is in the repository's SECURITY.md.