Martin BallandClaude Opus 5.5 5b5810fe1f CI: Scorecard hardening — release token write only on the release job, SECURITY.md, patched ctutils (#4975) ...

OpenSSF Scorecard (v5.6.0, 4.0/10) flagged:
- Token-Permissions: release.yml granted contents: write at the top level.
  Now read at the top, write on the release job only (same effective access).
- Security-Policy: no SECURITY.md. Added one pointing to GitHub private
  vulnerability reporting (already enabled on the repo).
- Vulnerabilities: ctutils 0.4.3 -> 0.4.7 (RUSTSEC-2026-0385); clipboard-win
  5.4.1 -> 5.4.3 (yanked).

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-30 13:00:27 -04:00

..

workflows

CI: Scorecard hardening — release token write only on the release job, SECURITY.md, patched ctutils (#4975)

2026-10-30 13:00:27 -04:00

dependabot.yml

ci: configure Dependabot for Cargo and GitHub Actions

2026-10-18 12:31:59 -06:00