mirror of
https://github.com/personamanagmentlayer/pcl.git
synced 2026-09-14 15:40:22 +08:00
ANGX
a0ce66f36e
Add multi-layered security measures to protect against common threats: ## Code Review & Access Control - Add CODEOWNERS file for mandatory reviews on critical files * Security policies and workflows * Governance and compliance documents * Core compiler components (lexer, parser, semantic, codegen, runtime) * Registry system and CLI commands * Build and deployment configurations ## Issue & PR Management - Add structured issue templates (bug report, feature request, security) - Add comprehensive PR template with security checklist - Configure issue template routing and contact links - Private vulnerability reporting guidance ## Secret & Credential Protection - Add Gitleaks configuration (.gitleaks.toml) * Custom rules for PCL-specific patterns * Generic secret detection (API keys, tokens, passwords) * Private key detection * Allowlist for false positives - Enhanced .gitignore for sensitive files * API keys and credentials (*.pem, *.key, secrets.json) * Cloud provider configs (AWS, Azure, GCP) * SSH keys and certificates * Environment-specific secrets ## Security Automation - Add security npm scripts to package.json * security:audit - npm audit with moderate level * security:audit:fix - automatic vulnerability fixes * security:secrets - gitleaks scanning helper * security:licenses - license compliance check * security:scan - comprehensive security check ## Documentation & Guidance - Add SECURITY_CHECKLIST.md for contributors * Pre-commit security checks * Code review security guidelines * Incident response procedures * Security best practices with code examples - Add docs/SECURITY_HARDENING.md * Complete security architecture overview * Tool usage instructions * Security metrics and SLAs * Vulnerability reporting process ## Security Features Added ✅ CODEOWNERS for mandatory reviews ✅ Issue/PR templates with security focus ✅ Gitleaks configuration for secret scanning ✅ Enhanced .gitignore for sensitive files ✅ Security automation scripts ✅ Comprehensive security documentation ✅ Security badges in README ## Defense-in-Depth Layers 1. Repository Security: CODEOWNERS, branch protection guidance 2. Dependency Security: Dependabot + npm audit automation 3. Secret Scanning: Gitleaks with custom rules 4. Automated Scanning: GitHub Actions security workflow 5. Secure Coding: Templates, checklists, documentation Ref: SECURITY.md, PCL_SECURITY_MODEL.md, OWASP Top 10
47 lines
1.2 KiB
TOML
47 lines
1.2 KiB
TOML
# Gitleaks Configuration for PCL Repository
|
|
# https://github.com/gitleaks/gitleaks
|
|
|
|
title = "PCL Security Scanning Configuration"
|
|
|
|
[extend]
|
|
useDefault = true
|
|
|
|
# Custom rules for PCL-specific patterns
|
|
[[rules]]
|
|
id = "pcl-api-key"
|
|
description = "PCL API Key"
|
|
regex = '''pcl[_-]?api[_-]?key\s*[:=]\s*['"]?([a-zA-Z0-9_\-]{32,})['"]?'''
|
|
tags = ["key", "PCL"]
|
|
|
|
[[rules]]
|
|
id = "generic-secret"
|
|
description = "Generic Secret"
|
|
regex = '''(?i)(secret|password|passwd|pwd|token)\s*[:=]\s*['"]?([^\s'"]{8,})['"]?'''
|
|
tags = ["secret", "generic"]
|
|
|
|
[[rules]]
|
|
id = "private-key"
|
|
description = "Private Key"
|
|
regex = '''-----BEGIN[ A-Z]*PRIVATE KEY-----'''
|
|
tags = ["key", "private"]
|
|
|
|
# Allowlist for false positives
|
|
[allowlist]
|
|
description = "Allowlist for false positives"
|
|
paths = [
|
|
'''.*\.md$''', # Markdown documentation examples
|
|
'''.*\.example$''', # Example files
|
|
'''tests/fixtures/.*''', # Test fixtures
|
|
'''examples/.*\.pcl$''' # Example PCL files
|
|
]
|
|
|
|
regexes = [
|
|
'''example[_-]?(key|token|secret)''', # Example credentials
|
|
'''test[_-]?(key|token|secret)''', # Test credentials
|
|
'''dummy[_-]?(key|token|secret)''', # Dummy credentials
|
|
'''YOUR_[A-Z_]+_HERE''', # Placeholder patterns
|
|
]
|
|
|
|
# Commits to exclude
|
|
commits = []
|