doc(security,aot): added security guidance around AoT binaries (#4867)

* doc(security,aot): added security guidance around AoT binaries

Adds explicit guidance distinguishing trusted AoT binaries from untrusted
Wasm binaries, clarifies that malformed/manipulated AoT files are bugs not
security issues, and cleans up wording in the security checklist section.


Signed-off-by: Stephen Berard <stephen.berard@outlook.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Author: srberard

doc/security_need_to_know.md

@@ -5,7 +5,6 @@ This document aims to explain the process of identifying a security issue and th
 ## identifying a security issue
 
 It is commonly stated that a security issue is an issue that:
-
 - Exposes sensitive information to unauthorized parties.
 - Allows unauthorized modification of data or system state.
 - Affects the availability of the system or its services.
@@ -15,13 +14,23 @@ It is commonly stated that a security issue is an issue that:
 
 Given that WASI is a set of Capability-based APIs, all unauthorized actions are not supposed to happen. Most of the above security concerns can be alleviated. What remains for us is to ensure that the execution of Wasm modules is secure. In other words, do not compromise the sandbox. Unless it is explicitly disabled beforehand.
 
+WebAssembly binaries are considered untrusted.  A Wasm binary that causes a breach of the Wasm sandbox or a crash of the runtime is considered to be a potential security issue.  On the other hand, Ahead-of-Time (AoT) binaries are assumed to be generated by a trusted source and using the supported toolchain.  Therefore, AoT binaries are considered trusted.  As such, malformed or manipulated AoT binaries that breach the sandbox or cause crashes of the runtime may be considered as bugs but are not classified as security issues.  
+
+If the AoT compiler and/or related tools emit an AoT binary that breaches the Wasm sandbox or causes the runtime to crash, this indicates a potential security issue in the AoT toolchain.  It is assumed that the correct configuration and options are used when generating AoT binaries.  Misconfiguration or misuse of the tooling options, therefore, is not considered to be a security issue.
+
 ### Is this bug considered a security vulnerability?
 
 #### For someone who finds a problem
+If a bug **causes a crash or hang**, treat it as a possible security issue and report it to a security advisor. A maintainer will review it and change its category if needed. When in doubt, report it as a security issue.
 
-if a bug **results in crash or hang**, please treat it as a security problem and report it to a security advisor. The maintainer will look into it and change its category if needed. It is better safe than sorry.
+If the person reporting the issue can answer "Yes" to any question in the checklist below, report it as a security issue. Otherwise, the issue can be treated as a regular bug.
 
-If the author of an issue(results in crash or hang) can go through the following checklist and answer all questions with "No", it is fine to mark it as a regular bug. If not, please report it as a security issue.
+Does the issue allow an WebAssembly binary to:
+- break out of the Wasm sandbox?
+- read or modify host memory, runtime memory, or another module's data when it should not?
+- use files, sockets, device access, or other host resources without being the granted capabilities?
+- call host functions or native APIs in a way that bypasses intended checks?
+- make the runtime unavailable or put it into an unrecoverable state?
 
 ---
 
@@ -35,7 +44,7 @@ Actions that differ from Wasm rules (like calculating wrong values) are not seen
 
 By default, native APIs and CLIs are following the principle of **caller guarantee**. If the caller provides incorrect parameters or users input malformed options, it is not a security issue. For example, if a user passes an invalid file descriptor to `fd_read`, it is not a security issue.
 
-.wasm are not trusted. Malformed .wasm files should be handled gracefully. If a .wasm file causes a runtime crash or hang, it is a security issue. On the other hand, it's expected that aot runtime alone doesn't provide the same guarantee. So user-crafted .aot can cause anything, including crashes or hangs. They are not considered security issues.
+WebAssembly binaries are not trusted. Malformed .wasm files should be handled gracefully. If a .wasm file causes a runtime crash or hang, it is a security issue. On the other hand, it's expected that aot runtime alone doesn't provide the same guarantee. So user-crafted .aot can cause anything, including crashes or hangs. They are not considered security issues.
 
 A denial-of-service (DoS) attack is a cyberattack that aims to make a computer or network resource unavailable to its users. If the service (runtime in this case) can recover and start another module or run another function within the same instance, it is not considered unavailable, and thus not a Denial of Service (DoS).