feat(security): ship a standard scanner toolchain to every overlaid repo - #8
Merged
Conversation
Every repo that is public or serves prod traffic gets the same gate: gitleaks, semgrep, osv-scanner, zizmor and eslint locally, plus a CI workflow with the same tools and npm audit. - claude/security-scan.sh: one script, ok/FAIL/skip per tool, exit 1 only on findings, skip when a tool is absent. Scans only what git sees (tracked + untracked-not-ignored) so build caches never count. Every tool runs under a timeout. - claude/verify.sh.tmpl: stage 2 calls the scanner. - claude/security.yml.tmpl, claude/dependabot.yml.tmpl: seeded once by overlay.sh, repo-owned after. All actions SHA-pinned, persist-credentials false, read-only token, cooldown 7 days. - overlay.sh: copies the scanner, seeds the two .github files, reports kept/differs, hints when verify.sh does not call the scanner. - claude/commands/security.md: runs the real tools; drops the claim that verify.sh scanned secrets (it never did). - setup-machine.sh: gitleaks, semgrep, osv-scanner, zizmor install by default; trivy, nmap, nuclei stay behind --with-security. - .claude/verify.sh check 64/64b: the scanner skips cleanly with no tools, fails on a stub finding, every workflow action is SHA-pinned. - README: prod-ready gates table; overlay lane inventory rows. - 1.67.0. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The first real CI run on a consumer repo failed on it. Git-root scanning is opt-in there, so dropping the flag keeps the behaviour. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Every repo that is public or serves prod traffic gets the same security gate, seeded by
vstack overlay .:.claude/security-scan.shsecurity.yml/securityci.ymlsecurity.yml/securitystep 5, against a preview URLclaude/security-scan.sh: ok/FAIL/skip per tool, exit 1 only on findings, skip when a tool is absent. Scans only what git sees, so.next/andnode_modules/never count. Every tool runs under a timeout.claude/security.yml.tmpl,claude/dependabot.yml.tmpl: seeded once, repo-owned after. Actions SHA-pinned,persist-credentials: false, read-only token,npm ci --ignore-scripts, cooldown 7 days.overlay.sh: copies the scanner, seeds the two.githubfiles, printskept ... (differs from template)on drift, hints whenverify.shdoes not call the scanner.claude/commands/security.md: runs the real tools. The old text claimedverify.shscanned secrets. It never did.setup-machine.sh: gitleaks, semgrep, osv-scanner, zizmor install by default.Proof
./.claude/verify.sh:checks: 65 declared, 64 ran, 1 skipped/VERIFIEDVSTACK_FALSIFY_ROWS="12 31 64 64b" tests/gate-falsifiability.sh:FALSIBILITY 7/7tests/inventory-contract.sh: 32 checks cleanchore/security-toolchain. The first real run caught 11 gitleaks hits in.next/(fixed the scanner's scope), a curl-pipe in a workflow, and a missing dependabot cooldown.After merge
Tag
v1.67.0, thenvstack updateon each machine, thenvstack overlay .in each repo and bump its.conductor/settings.tomlpin.Reviewed by SCARY-TERRY (code-reviewer, sonnet) and EVIL-MORTY (security-auditor, sonnet); both findings fixed before commit.
🤖 Generated with Claude Code