docs: SECURITY.md, CODEOWNERS, issue forms, CHANGELOG and a real release checklist - #83
Merged
Conversation
… policy - Enable GitHub private vulnerability reporting on the repo - Cover crash/ReDoS/traversal/exhaustion as in-scope advisories - State plainly that missed detections are public issues, not embargoed vulnerabilities (#80, #81, docs/DETECTION-BACKLOG.md) - Document supply-chain verification via signed SLSA attestation
- CODEOWNERS auto-requests maintainer review on workflows, patterns, src, SECURITY.md, and the (not-yet-present) code-scanning baseline; documents that it requests review rather than blocking merges - Disable blank issues; route contact links to the security advisory, SECURITY.md, and PATTERNS.md - bug_report.yml, pattern_proposal.yml, false_positive.yml issue forms with redaction warnings and a version field, since main is ahead of the released binary
- CHANGELOG.md follows Keep a Changelog 1.1.0: Unreleased (derived from git log v0.0.3..main, including PR #66's pattern-gap fill), 0.0.3, 0.0.2, 0.0.1. Dates from the GitHub releases API published_at, not STATE.md. Neither --baseline (#79) nor SARIF (#82) appear anywhere. - docs/RELEASE-CHECKLIST.md derived from release.yml: the four real jobs, six target triples, real asset names, the version-bump gate, the spec-ci-plugin consumer check, and the two do-not-change-this-back constraints (raw musl assets, ubuntu-latest runner)
…e merged The changelog was written while #79 and #82 were still open, so it deliberately omitted them. Both landed on main in the meantime (CLI-08 and CLI-04), so [Unreleased] was understating what is on main by two features. Also sharpens the raw_only entry: it was not 'previously implicit', it was inferred from a tag, and saying so is the point — that is the failure mode the field exists to prevent. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Aug 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Production-readiness hygiene: the files a public repo that other people's CI executes is expected to have, and did not. No behaviour change — no
src/file is touched.What lands
SECURITY.md.github/CODEOWNERSpatterns/,src/,SECURITY.md.github/ISSUE_TEMPLATE/config.ymlrouting security reports away from public issuesCHANGELOG.mddocs/RELEASE-CHECKLIST.mdrelease.ymlThings worth knowing
Private vulnerability reporting was disabled, so it has been enabled on the repo. Without that,
SECURITY.mdwould have pointed reporters at/security/advisories/new— a dead end — and the predictable outcome is a working bypass posted as a public issue.SECURITY.mdsays out loud that a missed detection is not an embargoed vulnerability. This tool ships a phrasebook of regexes; payloads it does not catch are expected, tracked publicly (#80, #81,docs/DETECTION-BACKLOG.md), and welcome as ordinary issues. A crash, a panic, ReDoS or a path traversal from a hostile scanned file is the opposite and gets the private channel. Blurring the two would either bury real bugs or embargo the backlog.Changelog dates come from the releases API, not
STATE.md— the two disagree in both directions.published_atgives v0.0.1 = 2026-04-02 (STATE.md said 04-01) and v0.0.3 = 2026-08-22 (STATE.md said 08-23). Correcting STATE.md is left as a separate call.config.ymldoes not link Discussions, which is disabled on this repo. A contact link to a disabled feature is a dead end for the person least able to work around it.The issue templates avoid version-specific flags.
main's README documents--strict,--fail-on,rules,explainandinstall-hook, none of which exist in the released v0.0.3 binary most people will be running. Templates are served frommainto users on the release, so--versionis a required field instead.Verification
Every new file scanned with the built binary under
--strict— exit 0, including.github/CODEOWNERSvia--all-files, since it is extensionless. That matters here: this repo scans itself and CI enforces a zero-finding gate, so a document about injection is an easy way to break your own build. No verbatim payload was written into any new file.Independently re-verified rather than taken from the executor's report: private vulnerability reporting really returns
enabled: true, all four issue forms parse as YAML, the three changelog dates match the API exactly, and the checklist's target triples, asset names andgh attestation verifyinvocation all appear inrelease.yml..github/workflows/ci.ymlis untouched.Ordering note
The changelog was written while #79 and #82 were still open and deliberately excluded them. Both merged during this work, so a follow-up commit adds
--baselineand SARIF to[Unreleased].Planning artifacts:
.planning/quick/260828-cli-repo-hygiene-for-production-readiness-se/.🤖 Generated with Claude Code