36 lines
1.1 KiB
Markdown
36 lines
1.1 KiB
Markdown
# Local Security Scan Goal
|
|
|
|
## Outcome
|
|
|
|
Eliminate the current repo-wide local security scanner error backlog so `npm run security:scan` exits successfully.
|
|
|
|
## Baseline
|
|
|
|
As of 2026-07-05, the broad local scanner reports 38 error findings after the CSV-backed Codex security remediation was completed. The failures are mostly `SEC009` hardcoded credential examples, plus `SEC002`, `SEC004`, and `SEC011` documentation patterns.
|
|
|
|
## Scope
|
|
|
|
- Fix canonical skill sources under `skills/`.
|
|
- Regenerate mirrored plugin distributions after canonical edits.
|
|
- Keep existing warning findings out of scope unless they are cheap collateral cleanup.
|
|
- Do not weaken scanner patterns, suppress findings with broad allowlists, or narrow the scanner target to make the check pass.
|
|
- Do not commit, push, publish, or release without a separate user request.
|
|
|
|
## Verification
|
|
|
|
Primary verifier:
|
|
|
|
```bash
|
|
npm run security:scan
|
|
```
|
|
|
|
Supporting checks:
|
|
|
|
```bash
|
|
npm run validate
|
|
npm run security:docs
|
|
npm run bundles:check
|
|
```
|
|
|
|
Completion proof requires the primary verifier to report zero errors and exit successfully.
|