Skip to content

fix: remediate PR #461 attribution and review findings #462

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mattaereal merged 1 commit into from
Apr 21, 2026
Merged

fix: remediate PR #461 attribution and review findings #462

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions docs/pages/devsecops/code-signing.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,9 @@ tags:
- DevOps
contributors:
- role: wrote
users: [frameworks-volunteer]
users: [mattaereal]
- role: reviewed
users: []
users: [scode2277]
---

import { TagList, AttributionList, TagProvider, TagFilter, ContributeFooter } from '../../../components'
Expand Down Expand Up @@ -193,7 +193,7 @@ A signature is meaningless if the verifying party cannot obtain the correct
public key.

- Upload your public key to GitHub (Settings > SSH and GPG keys) and to a
public keyserver (keys.openpgp.org, keys.mailvelope.com).
public keyserver (keys.openpgp.org, keyserver.ubuntu.com).
- Use the same key across all platforms so that the identity is consistent.
- In CI, pin trusted public key fingerprints in the pipeline configuration.
Reject signatures from unknown keys.
Expand Down
6 changes: 3 additions & 3 deletions docs/pages/devsecops/continuous-integration-continuous-deployment.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,9 @@ tags:
- SRE
contributors:
- role: wrote
users: [frameworks-volunteer]
users: [mattaereal]
- role: reviewed
users: []
users: [scode2277]
---

import { TagList, AttributionList, TagProvider, TagFilter, ContributeFooter } from '../../../components'
Expand Down Expand Up @@ -336,7 +336,7 @@ to CI/CD pipeline security.
- [SLSA Specification v1.0](https://slsa.dev/spec/v1.0/)
- [NIST SP 800-218, Secure Software Development Framework](https://csrc.nist.gov/pubs/sp/800/218/final)
- [GitHub Docs: Security hardening for GitHub Actions](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions)
- [CISA: Securing the Software Supply Chain for Developers](https://www.cisa.gov/sbom)
- [CISA: Software Bill of Materials](https://www.cisa.gov/sbom)
- [OWASP CI/CD Security Guide](https://owasp.org/www-project-devsecops-guideline/latest/03-CI-CD/)

---
Expand Down
4 changes: 2 additions & 2 deletions docs/pages/devsecops/repository-hardening.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,9 @@ tags:
- DevOps
contributors:
- role: wrote
users: [frameworks-volunteer]
users: [mattaereal]
- role: reviewed
users: []
users: [scode2277]
---

import { TagList, AttributionList, TagProvider, TagFilter, ContributeFooter } from '../../../components'
Expand Down
8 changes: 5 additions & 3 deletions docs/pages/devsecops/security-testing.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,9 @@ tags:
- SRE
contributors:
- role: wrote
users: [frameworks-volunteer]
users: [mattaereal]
- role: reviewed
users: []
users: [scode2277]
---

import { TagList, AttributionList, TagProvider, TagFilter, ContributeFooter } from '../../../components'
Expand Down Expand Up @@ -161,6 +161,8 @@ rules:
severity: ERROR
languages: [javascript, python, solidity]

# NOTE: This is a simplified example. In production, use a more specific
# pattern that matches actual sensitive variables, not any spread argument.
- id: sensitive-data-logging
pattern: console.log(...$SENSITIVE)
message: Do not log sensitive data in production.
Expand Down Expand Up @@ -188,7 +190,7 @@ ignore alerts, real findings get missed.
# nosemgrep: hardcoded-private-key
# Reason: Test fixtures only — not real keys.
# Ticket: SEC-1234, suppress until test fixture refactored.
# Expiry: 2025-06-01
# Expiry: 2027-06-01
```

Every suppression should include: the finding ID, why it is a false positive,
Expand Down
Loading