security: least-privilege CI token + SECURITY.md (Scorecard fixes)#13
Merged
Conversation
OpenSSF Scorecard scored the repo 3.0/10. The two zero-score checks fixable from inside the repo: - Token-Permissions: ci.yml had no permissions block, so jobs got the default token with write access to contents. Build-and-test needs read-only. - Security-Policy: no SECURITY.md; reporters had no private path and would have to open a public issue for a vulnerability.
Ti-03
added a commit
that referenced
this pull request
Jul 24, 2026
…OWNERS, license notice (#20) Week 9 (OSS licensing & foundations): fill the Community Standards checklist. CONTRIBUTING covers setup/tests/bug-filing/PR conventions/ review expectations plus an explicit contribution-licensing clause: the repo is AGPL-3.0 while the same app ships on the Mac App Store, which only works because the maintainer holds copyright, so inbound contributions grant App Store distribution too. CODE_OF_CONDUCT is Contributor Covenant 2.1 verbatim. GOVERNANCE documents the honest BDFL model, what a no looks like, and the path to shared maintainership. README gains the copyright line (year + holder) the license lacked and a License section explaining the AGPL choice. SECURITY.md intentionally not duplicated here: it is on the ci/scorecard-hardening branch (PR #13).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
ci.yml: top-levelpermissions: contents: read(least privilege).SECURITY.md: private reporting via GitHub Security Advisories, supported versions, response expectations.Why
Week 7, task 4: ran OpenSSF Scorecard on this repo, aggregate 3.0/10. Of the twelve zero-score checks, most need process or settings changes (branch protection, code review, fuzzing). The two fixable by PR are Token-Permissions (workflows get a default token that can write contents; the 2024 tj-actions incident shows why that matters) and Security-Policy (no private reporting path existed).
Related: #12 fixes two more zero-score checks (Dependency-Update-Tool via Dependabot, Pinned-Dependencies via SHA pins).
Test
scorecard --repo=github.com/Ti-03/MacDirStatre-run after merge should move Token-Permissions and Security-Policy off 0.