Security policy

This repository ships a reference monorepo and the decisions behind it. It runs no service and collects nothing. The realistic surface is what an adopter copies: the session gates, the redirect handling, the CI templates and the supply-chain policy - a weak default here becomes a weak default in every repository that adopts it.

Reporting

Found a default that is unsafe once copied - a gate that can be walked past, a redirect that survives a round trip, a workflow with more permission than it needs? Email bodurkalukasz@gmail.com with the file and the scenario. You will get an answer within 7 days. Please do not open a public issue for anything exploitable before it is fixed.

The starter's own guards are the first place to look: the boot pulse asserts them on every push, so a report that makes the pulse red is the most useful shape a report can take.

Not secrets

No credentials or tokens live here. The starter's env is schema-validated at boot and every value comes from the environment; a committed secret would be a security report, not a convenience.