8000 Security · dominicusin/dominicusin.github.io Wiki · GitHub
[go: up one dir, main page]
Skip to content

Security

Jump to bottom
Domini Montessori edited this page Aug 20, 2026 · 1 revision

Security

Supply-chain and application-security posture for dominicusin.github.io.

Code scanning (CodeQL)

  • Alerts: 0 (as of 2026-08-20). 8 src/ alerts fixed in code; 11 scripts/ alerts closed as won't fix (build-time utilities, covered by codeql-config.yml paths-ignore).
  • Config: .github/codeql/codeql-config.yml.

Secret scanning

  • Resolved: Firebase web config is public-by-design (false positive).
  • Gitleaks runs in security-scan.yml.

Attestations (SLSA)

  • actions/attest@v4.2.2 (Generate Generic Attestations) runs on:
    • sbom.yml — attests the generated SBOM (sbom.spdx.json).
    • hugo.yml — attests the built site artifact (./public).

Dependency hygiene

  • Dependabot active (dependabot.yml).
  • dependency-review.yml blocks PRs introducing new vulnerabilities.
  • license-check.yml enforces a permissive license allowlist.

Hardening notes

  • DA0 contracts compile/test under Hardhat 2.x (3.x breaks the CommonJS config + chai-matchers). See issue #202 / milestone "CI/CD Hardening".
  • Deploy DAO contracts and Fortify AST Scan are gated on secrets and skip gracefully when absent (non-blocking).

Clone this wiki locally
0