box-fetch-processor — Design (DEFERRED)

Status: DEFERRED. Box explicitly states it does not maintain a public list of externally reported security issues. Disclosure happens via private HackerOne. Public artifacts: a status page (uptime only) and one-off blog posts. No feed, no GHSAs, no PSIRT.

1. Overview

  • Tier: Tier-3 SaaS (Phase 5)
  • Verdict: DEFERRED
  • Reason in one sentence: Box’s public security posture is HackerOne-private; no advisory feed exists in any form.

2. Source contract (Phase 0 recon — 2026-05-09)

Recon-protocol grid:

StepCheckFinding
1–6All advisory-feed pathsNone
7CVE alias presenceOnly via Box’s one-off blog posts (Log4j 2021); no canonical feed
8Anti-botN/A — pages reachable, content empty of advisories

URLs checked:

  • https://www.box.com/security — 200; marketing only
  • https://www.box.com/about-us/security — 200; explicitly: “Box does NOT maintain a public facing list of externally reported issues”
  • https://www.box.com/trust — 200; marketing/compliance content
  • https://status.box.com — 200; uptime status only, no CVE content
  • https://trust.box.com — 302; gated/marketing
  • https://github.com/box — 200; pinned repos (boxcli, sdks, box-ui-elements) with no GHSAs published; empty /security/advisories API on each
  • https://blog.box.com/boxs-statement-recent-log4j-vulnerability-cve-2021-44228 — single one-off Log4j post (5+ years old, no follow-up posts)

11. Deferral rationale + unblock conditions

What we’d accept to flip this to implementable:

  1. Box launches box.com/security/advisories index with CVE-tagged bulletins.
  2. Box starts publishing per-repo GHSAs on github.com/box/boxcli or sibling SDKs.
  3. Box moves trust.box.com to a public AuditBoard / SafeBase trust portal with disclosed advisories.

Related work:

  • Box-affecting CVEs (when assigned at all) land in NVD/MITRE, which the existing nist-nvd-*-processor and mitre-cve-json-processor cover.

Volume justification: One Log4j-commentary post in 5+ years — well below the commentary-enricher ROI bar (cf. Vultr §15.8 deferral, also <5/year).

Recheck cadence: every 12 months. Next 2027-05-09.

S3 Persistence

Not used. This processor does not currently archive payloads or quarantine failures to S3. Per the S3 Persistence Contract this is non-compliant — see the compliance matrix for the implementation roadmap.

⚠ Not in the compliance matrix — status needs verification.

Expected paths when implemented:

  • Archive: box/files/{sha256}/{filename}
  • Quarantine: failed-feeds/box-fetch-processor/{YYYY-MM-DD}/{reason}/{filename}
  • Likely reasons: (none documented)