We actively support the following versions with security updates:

We take security vulnerabilities seriously. If you discover a security issue, please report it responsibly.

Do NOT report security vulnerabilities through public GitHub issues.

Instead, please report them via one of the following methods:

1. GitHub Security Advisories (Preferred)

   • Go to the Security Advisories page of this repository
   • Click "New draft security advisory"
   • Fill in the details and submit

2. Email

   • Send details to the repository maintainers
   • Include "SECURITY" in the subject line

Please include the following information in your report:

• Description: A clear description of the vulnerability
• Impact: The potential impact of the vulnerability
• Steps to Reproduce: Detailed steps to reproduce the issue
• Affected Versions: Which versions are affected
• Suggested Fix: If you have one (optional)

• Acknowledgment: We will acknowledge receipt within 48 hours
• Initial Assessment: We will provide an initial assessment within 7 days
• Resolution Timeline: We aim to resolve critical issues within 30 days
• Credit: We will credit reporters in the security advisory (unless you prefer to remain anonymous)

This security policy applies to:

• The source code and configuration files in this repository
• GitHub Actions workflows provided by this repository
• Python utilities and scripts maintained in this repository

The following are generally out of scope:

• Vulnerabilities in upstream dependencies (report these to the respective projects)
• Issues that require physical access to a user's machine
• Social engineering attacks
• Denial of service attacks that require significant resources

This project implements several security measures:

• CodeQL: Automated code scanning for Python and GitHub Actions
• Bandit: Python security linter integrated in CI and pre-commit
• Secret Scanning: GitHub secret scanning enabled on this repository

• SLSA Provenance: Build attestations for release artifacts (public repositories only)
• SBOM: Software Bill of Materials attached to every GitHub Release (see SBOM Retrieval below)
• Locked Dependencies: uv.lock ensures reproducible builds
• Dependabot: Automated dependency updates with security patches (version and security updates)
• Renovate: Additional automated dependency update management

• OIDC Publishing: PyPI trusted publishing without stored credentials
• SBOM Attestations: CycloneDX SBOMs generated and attested for release artifacts (public repositories only)
• Tag Protection: Releases require version tag validation

Every release of this project includes a Software Bill of Materials (SBOM) so that consumers can audit the exact dependency tree used to build the package.

SBOMs are generated using CycloneDX — an industry-standard format for software supply chain security — in two machine-readable representations:

GitHub Release assets (recommended)

The SBOM files are attached directly to each GitHub Release. To download them:

1. Go to the Releases page of this repository.
2. Open the release you are interested in (e.g. v1.2.3).
3. Under Assets, download sbom.cdx.json or sbom.cdx.xml.

You can also download them with curl or gh:

# Using the GitHub CLI
gh release download v1.2.3 --repo Jebel-Quant/rhiza-hooks --pattern 'sbom.*'

# Using curl (replace <tag> and <org/repo> as needed)
curl -L https://github.com/Jebel-Quant/rhiza-hooks/releases/download/v1.2.3/sbom.cdx.json -o sbom.cdx.json

SBOM attestations (public repositories only)

For public releases an attestation is also created via actions/attest, which cryptographically binds the SBOM to the release workflow run. You can verify the attestation with the GitHub CLI:

gh attestation verify sbom.cdx.json --repo Jebel-Quant/rhiza-hooks

The CycloneDX JSON/XML files can be ingested by any tool that supports the CycloneDX schema (v1.6+), including:

• OWASP Dependency-Track
• Grype
• Trivy
• cdxgen
• Any tool that understands the CycloneDX specification

1. Keep Updated: Regularly update dependencies and review security advisories
2. Review Changes: Review dependency update PRs before merging
3. Enable Security Features: Enable CodeQL, secret scanning, and Dependabot in your repositories
4. Use Locked Dependencies: Always commit uv.lock for reproducible builds
5. Configure Branch Protection: Require PR reviews and status checks

We thank the security researchers and community members who help keep this project secure.