Security

🔒 Security

CodeQL Static Analysis

ZASI runs GitHub Advanced Security CodeQL scans on every push to main and weekly.

Languages scanned: Python · JavaScript/TypeScript · GitHub Actions

All alerts resolved as of v32.0.0:

Alert	Rule	Fix Applied
DOM XSS in app.js:170	js/xss-through-dom	Replaced innerHTML with safe textContent DOM nodes
Untrusted CDN scripts index.html	js/inclusion-of-functionality-from-untrusted-source	Added SRI hashes + crossorigin="anonymous"
Sensitive data in logs main.py:337, 966	py/clear-text-logging-sensitive-data	Removed cryptographic field references from print output
Workflow missing permissions (×5)	actions/missing-workflow-permissions	Added permissions: contents: read to all jobs

Subresource Integrity (SRI)

All CDN scripts in web/index.html carry exact SHA-384/512 integrity hashes verified against the live unpkg/cdnjs responses.

API Authentication

Set ZASI_API_KEY env var to enable authentication. All /api/* endpoints (except /api/status) require:

X-API-Key: <your-key>

Dependabot

.github/dependabot.yml monitors:

• pip dependencies (weekly)
• npm dependencies (weekly)
• github-actions (weekly)