The first CodeQL code-scanning batch on the repo is triaged and closed. Fourteen alerts were false positives, dismissed with a written reason on each; three were real and are fixed here, alongside a new standard and a contributor front door for how security findings are handled from now on.
Security
- PR #20 - response header values are stripped of CR/LF at the single choke point in the request handler, so a guessed MIME type or a Content-Disposition filename from a browse path can no longer inject headers or split the response (CWE-113).
- PR #24 - the no-private-data workflow runs with a least-privilege token (contents: read), which is all it needs to check out and scan.
Docs
- PR #25 - adds a CONTRIBUTING front door and a security response standard (claim and self-assign, triage, dismissal with a retained record, fixing under the PR conventions), and separates contributor docs from the user-facing report and lead standards.
- PR #27 - extends the security response standard to externally reported vulnerabilities: private intake, validate and dupe-check before opening a draft advisory, a CVE request, and a "what is safe to publish" rule.
- PR #28 - retires the root CLAUDE.md and consolidates the contributor process into CONTRIBUTING.md, so the repo root carries no dev-only agent file.
Upgrade notes
Pull and rebuild. No configuration, data or API changes, and nothing an operator must do.