⚠️ IMPORTANT NOTE:

This project follows best-practice security, but cannot guarantee 100% protection against zero-day exploits or highly targeted attacks. For enterprise-grade security requirements, use commercially supported solutions with dedicated threat intelligence.

Considered attack vectors (prioritized by likelihood/risk):

1. Supply chain
2. Dependency updating

All CI jobs are protected by StepSecurity Harden Runner, which monitors outbound network and process activity on the runner at runtime.

Third-party Actions are referenced by tag rather than commit SHA. SHA pinning is intentionally not used — it only provides strong guarantees when combined with manual review of every upstream commit, which this single-developer project cannot sustain. Runtime monitoring via Harden Runner is the primary supply-chain control instead.

Dependencies are kept up to date using Renovate.

• Regular (non-security) updates:

  • Checked at least weekly.
  • A minimumReleaseAge of 3 days is applied, so only versions that have been out for a while are adopted for normal updates.

• Security-related updates:

  • Processed without artificial delay — security patches are not held back by minimumReleaseAge.
  • Renovate security advisories and/or GitHub’s security alerts are handled as soon as possible once available.

If you discover a security vulnerability, please use the Security tab to report it privately.
Do not disclose security vulnerabilities publicly before they have been addressed.