mudocs
Repo ↗

Section

Security

Tamper resistance, sandboxing, remote scan policy, and security deep dives.

Curated · top deep dives

Anti-Tamper Probe Enablement LLD This LLD defines how anti-tamper probe execution is enabled, how runner enforcement is gated, and how diagnostics differ from enforcement.Security Architecture Diagrams (Code-Synced) Visual reference for how Mutant's runtime security pipeline, policy decisions, and probe gates fit together, kept in sync with current code behavior.Security LLD Traceability Matrix This document provides end-to-end traceability from security design intent to concrete implementation and validation.Anti-Tamper Probe Integration This document explains how anti-tamper probes work today in Mutant, including the exact enablement gates and how runner enforcement differs from builtin diagnostic calls.

Security advisories

Mutant advisories

13 published, each with the fixture that holds its fix. Severity, affected versions and CVSS vectors are in the index.

  • MVF-2026-0001 compiling a program ran whatever builtins its macros called
  • MVF-2026-0002 the disclosure ledger's own records could be redacted
  • MVF-2026-0003 an audit log with its first entries deleted verified as intact
  • MVF-2026-0004 an audit entry with no sequence number ended the walk as though intact
  • MVF-2026-0005 two strings sharing one 64-bit digest were one hash entry
  • MVF-2026-0006 a relabelled disclosure package verified against the genuine root
  • MVF-2026-0007 a SQL query the documentation called read-only could modify evidence
  • MVF-2026-0008 a classified buffer put in a report table was rendered to hex and written out
  • MVF-2026-0009 an inherited environment variable chose the signing key and the trust anchor
  • MVF-2026-0010 the editor extension's release task passed the password in the argument list
  • MVF-2026-0011 a ledger redacted by an older build could have lost a withdrawal silently
  • MVF-2026-0012 a header count sized an allocation before the bytes were there
  • MVF-2026-0013 a binary plist that shares its containers expanded exponentially

Everything else in security

Security Policy Mutant is a language for security research and digital forensics. Its binaries sign and encrypt bytecode, detect tampering, and read memory, processes and disk images. Configuration Policy Mutant takes no configuration from environment variables. Using Mutant must never require anyone to set, or even think about, an environment variable. Evidence Handling Policy Mutant does not modify evidence. An image, volume, partition table, registry hive, archive or captured artifact opened by a Mutant program is read and never written, and the chain-of-custody manifest… Disclosure Policy A disclosure grants a key, not a copy. The encrypted record a recipient receives is byte-identical to the one under custody, and what distinguishes one recipient from another is the set of segment… Security Answers (Current Code) This FAQ is the student-friendly, code-accurate version of Mutant security behavior. Security Enhancements Roadmap (Code-Synced) This document tracks enhancement work from current implementation to future hardening. Anti-Tamper Probe Enablement LLD This LLD defines how anti-tamper probe execution is enabled, how runner enforcement is gated, and how diagnostics differ from enforcement. Remote Process Scan Deep Dive This document describes the current remote process scan architecture and integration points. Security LLD Traceability Matrix This document provides end-to-end traceability from security design intent to concrete implementation and validation.