From e975c3b613ed1150ac1ddf40168dbfda2ed251cd Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Thu, 10 Sep 2026 00:40:24 +0000 Subject: [PATCH 1/3] root - chore: defense - record repository lockdown as applied Repo admin applied lockdown-repo.sh (PRs required on main, tag ruleset, immutable releases, fork-PR approval, read-only tokens, Actions allowlist, secret scanning, Dependabot off). Do not commit the script. Leave Socket, npm secrets, and (manual) items unchecked. Co-authored-by: Jared Wray --- DEFENSE_IN_DEPTH.md | 2 +- SECURITY.md | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/DEFENSE_IN_DEPTH.md b/DEFENSE_IN_DEPTH.md index 34878c9..ab774bf 100644 --- a/DEFENSE_IN_DEPTH.md +++ b/DEFENSE_IN_DEPTH.md @@ -50,4 +50,4 @@ Profile: npm library · public ## 7. Repository lockdown - [ ] Phishing-resistant 2FA (passkeys / hardware keys) on the GitHub and npm accounts (manual) - [ ] Recovery codes stored offline in a password manager (manual) -- [ ] `lockdown-repo.sh` applied by a repo admin (never committed to this repo); `--check` with `--required-checks` and `--allowed-actions` passes (PRs required on the default branch, merges blocked unless required status checks pass, tag ruleset, immutable releases, fork-PR approval (public repos), read-only workflow tokens, Actions allowlist, secret scanning, Dependabot disabled, private vulnerability reporting (public repos)) +- [x] `lockdown-repo.sh` applied by a repo admin (never committed to this repo); `--check` with `--required-checks` and `--allowed-actions` passes (PRs required on the default branch, merges blocked unless required status checks pass, tag ruleset, immutable releases, fork-PR approval (public repos), read-only workflow tokens, Actions allowlist, secret scanning, Dependabot disabled, private vulnerability reporting (public repos)) — verified 2026-09-10 (admin apply; `--required-checks "zizmor,build"` `--allowed-actions "pnpm/*,codecov/*"`) diff --git a/SECURITY.md b/SECURITY.md index 1d4d1b8..a0aa683 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -23,9 +23,12 @@ We will acknowledge receipt, work with you on a coordinated disclosure timeline, This repository follows the [defense-in-depth](https://github.com/jaredwray/agentic/blob/main/skills/security/defense-in-depth-nodejs/SKILL.md) hardening checklist; progress is tracked in [DEFENSE_IN_DEPTH.md](./DEFENSE_IN_DEPTH.md). Measures currently in place: +- All changes land through pull requests — direct pushes to `main` are blocked, and merging requires the `zizmor` and `build` status checks. Tags can only be created by repository admins; published GitHub Releases are immutable. +- Workflow runs from outside collaborators require maintainer approval. Default workflow tokens are read-only, and only allowlisted GitHub Actions can run (`zizmorcore/*`, `SocketDev/*`, `pnpm/*`, `codecov/*`, plus GitHub-owned and verified creators). +- Secret scanning and push protection are enabled. Dependabot alerts and security-update PRs are off; there is no Dependabot config. - pnpm is pinned via `packageManager` (`pnpm@12.3.0`). - Dependencies install through pnpm with a 7-day cooldown on new versions, lifecycle scripts blocked by default, `trustPolicy: no-downgrade`, and exotic subdependencies blocked. -- The lockfile is committed and CI installs with `--frozen-lockfile`. There is no Dependabot config; dependency updates go through reviewed PRs. +- The lockfile is committed and CI installs with `--frozen-lockfile`. - CI workflows default to read-only `contents: read` permissions; generated output is never committed back from CI; every action is pinned to a full commit SHA; Socket Firewall (`sfw`) wraps `pnpm install`; zizmor lints workflows on every PR; checkouts that do not push set `persist-credentials: false`. - The release workflow disables `setup-node` package-manager caching and stages packed tarballs with `pnpm stage publish` instead of publishing live. - Workflows do not use `pull_request_target`. From f1d8150907d35d111027d82f15a4de2d37752a59 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Thu, 10 Sep 2026 00:40:54 +0000 Subject: [PATCH 2/3] docs: cite PR #77 on the lockdown catalog item Co-authored-by: Jared Wray --- DEFENSE_IN_DEPTH.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/DEFENSE_IN_DEPTH.md b/DEFENSE_IN_DEPTH.md index ab774bf..e7d654c 100644 --- a/DEFENSE_IN_DEPTH.md +++ b/DEFENSE_IN_DEPTH.md @@ -50,4 +50,4 @@ Profile: npm library · public ## 7. Repository lockdown - [ ] Phishing-resistant 2FA (passkeys / hardware keys) on the GitHub and npm accounts (manual) - [ ] Recovery codes stored offline in a password manager (manual) -- [x] `lockdown-repo.sh` applied by a repo admin (never committed to this repo); `--check` with `--required-checks` and `--allowed-actions` passes (PRs required on the default branch, merges blocked unless required status checks pass, tag ruleset, immutable releases, fork-PR approval (public repos), read-only workflow tokens, Actions allowlist, secret scanning, Dependabot disabled, private vulnerability reporting (public repos)) — verified 2026-09-10 (admin apply; `--required-checks "zizmor,build"` `--allowed-actions "pnpm/*,codecov/*"`) +- [x] `lockdown-repo.sh` applied by a repo admin (never committed to this repo); `--check` with `--required-checks` and `--allowed-actions` passes (PRs required on the default branch, merges blocked unless required status checks pass, tag ruleset, immutable releases, fork-PR approval (public repos), read-only workflow tokens, Actions allowlist, secret scanning, Dependabot disabled, private vulnerability reporting (public repos)) — PR #77 (admin apply 2026-09-10; `--required-checks "zizmor,build"` `--allowed-actions "pnpm/*,codecov/*"`) From 37f3380f54be9f254300ebd2feb8f3d4b86ff800 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Thu, 10 Sep 2026 00:46:10 +0000 Subject: [PATCH 3/3] docs: note lockdown --check is unverified from this token Co-authored-by: Jared Wray --- DEFENSE_IN_DEPTH.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/DEFENSE_IN_DEPTH.md b/DEFENSE_IN_DEPTH.md index e7d654c..1973db6 100644 --- a/DEFENSE_IN_DEPTH.md +++ b/DEFENSE_IN_DEPTH.md @@ -50,4 +50,4 @@ Profile: npm library · public ## 7. Repository lockdown - [ ] Phishing-resistant 2FA (passkeys / hardware keys) on the GitHub and npm accounts (manual) - [ ] Recovery codes stored offline in a password manager (manual) -- [x] `lockdown-repo.sh` applied by a repo admin (never committed to this repo); `--check` with `--required-checks` and `--allowed-actions` passes (PRs required on the default branch, merges blocked unless required status checks pass, tag ruleset, immutable releases, fork-PR approval (public repos), read-only workflow tokens, Actions allowlist, secret scanning, Dependabot disabled, private vulnerability reporting (public repos)) — PR #77 (admin apply 2026-09-10; `--required-checks "zizmor,build"` `--allowed-actions "pnpm/*,codecov/*"`) +- [x] `lockdown-repo.sh` applied by a repo admin (never committed to this repo); `--check` with `--required-checks` and `--allowed-actions` passes (PRs required on the default branch, merges blocked unless required status checks pass, tag ruleset, immutable releases, fork-PR approval (public repos), read-only workflow tokens, Actions allowlist, secret scanning, Dependabot disabled, private vulnerability reporting (public repos)) — PR #77 (admin apply 2026-09-10, all 9 settings ✓; this token’s `--check` 403s Actions permission APIs; rulesets `Pull requests required` and `Tags only by admins` confirmed via API)