Skip to content

ARTART: clarify SHOULD language (Sections 3.1, 3.2, 3.6, 3.10)#49

Merged
yaronf merged 2 commits into
mainfrom
ys-artart-shoulds
Jul 16, 2026
Merged

ARTART: clarify SHOULD language (Sections 3.1, 3.2, 3.6, 3.10)#49
yaronf merged 2 commits into
mainfrom
ys-artart-shoulds

Conversation

@yaronf

@yaronf yaronf commented Jul 13, 2026

Copy link
Copy Markdown
Collaborator

Summary

Addresses the remaining ARTART review comments from @smyslov on SHOULD language outside Section 3.11 (#42 remainder):

  • §3.1: Demoted defensive allowlist guidance from normative SHOULD to a non-normative best practice ("libraries should…")
  • §3.2: Deterministic ECDSA: SHOULD, unless this is not reasonably implementable
  • §3.6: Avoid compression: SHOULD NOT, unless this risk is outside the applicable threat model
  • §3.10: SSRF protection: SHOULD, unless there are no local resources to protect (e.g., a hosted sandbox)

Also promoted one requirement: when no URL allowlist is available, checking what a hostname resolves to (and avoiding loopback/local addresses) changes from SHOULD to MUST.

Adds a -07 document history entry.

Issues

Closes #42

Note

Independent of #47 (Section 3.11). Both add a -07 history entry; combine when both land.

Made with Cursor

…3.10).

Add unless conditions, demote §3.1 defensive guidance to a non-normative
best practice, and strengthen the hostname-resolution fallback to MUST.

Co-authored-by: Cursor <cursoragent@cursor.com>
@yaronf
yaronf requested review from dickhardt and selfissued July 13, 2026 18:55

@dickhardt dickhardt left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@yaronf
yaronf merged commit 98ed9be into main Jul 16, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ARTART: Add conditions for when SHOULDs may be ignored (§§3.1, 3.2, 3.6, 3.10, 3.11)

3 participants