Files

Claude f326194de0 Remove Trivy vulnerability scanning from pipeline

Removed all Trivy-related security scanning:
- Removed "Extract first tag for Trivy" step
- Removed "Run Trivy vulnerability scanner" step
- Removed "Upload Trivy results to GitHub Security" step
- Removed "Run Trivy in table format" step
- Removed security-events permission (no longer needed)

Updated SECURITY.md:
- Removed Trivy vulnerability scanning references
- Removed SARIF upload references
- Kept other security measures intact

The workflow now focuses on:
- Fork PR protection
- SBOM generation
- Provenance attestation
- Dependabot updates

2025-11-04 21:52:02 +00:00

2.4 KiB

Raw Blame History

Security Policy

Supported Versions

We release patches for security vulnerabilities for the following versions:

Version	Supported
latest	✅
< 1.0	❌

Reporting a Vulnerability

If you discover a security vulnerability, please report it by:

DO NOT open a public issue
Email the maintainers or use GitHub's private vulnerability reporting
Include detailed information about the vulnerability:
- Type of vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)

We will respond within 48 hours and provide regular updates on the fix progress.

Security Measures

Build Pipeline Security

Our CI/CD pipeline implements multiple security layers:

Fork PR Protection: Pull requests from forks require manual approval (via safe-to-build label) before builds run
SBOM Generation: Software Bill of Materials is generated for all builds
Provenance Attestation: Build provenance is recorded for supply chain security
Limited Permissions: Workflows use minimal required permissions
No Push from PRs: Pull requests only build images locally, never push to registry

Container Security

Multi-architecture support (amd64, arm64)
Regular base image updates
Minimal attack surface
Non-root user execution where possible

Dependency Management

Automated dependency updates via Dependabot
Security alerts enabled
Regular security audits

Security Best Practices for Contributors

When contributing:

Never commit secrets, tokens, or credentials
Use environment variables for sensitive configuration
Keep dependencies up to date
Follow principle of least privilege
Validate and sanitize all user inputs
Use parameterized queries for database operations

Automated Security Checks

Our repository includes:

Dependabot for dependency updates
GitHub Security Advisories monitoring

Safe-to-Build Label

For maintainers reviewing fork PRs:

Review the PR code thoroughly for malicious content
Check for suspicious file modifications
Verify no secrets or credentials are exposed
Only add safe-to-build label if code is verified safe
Remove label immediately if concerns arise

Security Updates

Security updates are prioritized and released as soon as possible. Subscribe to repository releases to stay informed.

2.4 KiB Raw Blame History