Reference
Security
EGC maintains a layered security posture: static analysis, supply chain protection, continuous fuzzing, and community-driven scoring.
Security posture
CodeQL
Static analysis on every PR and weekly scheduled scans. Covers JavaScript and TypeScript. Advanced query suite enabled.
SonarCloud
Continuous code quality and security analysis. Tracks reliability, maintainability, and security hotspots on every push.
Dependabot
Automated dependency update PRs. Grouped by ecosystem (npm). Security alerts and auto-dismissal of dev-only patches enabled.
Dependency Review
Every PR is scanned for newly introduced vulnerable or license-incompatible dependencies before merge.
ClusterFuzzLite
Fuzzing harness wired for ClusterFuzzLite. JavaScript coverage is blocked by an upstream issue tracked publicly in #910; the structure is ready to activate the moment upstream ships a fix.
OpenSSF Scorecard
Weekly automated scoring across 20+ security checks: branch protection, signed releases, CI, token permissions, and more.
OpenSSF Best Practices
CII Best Practices badge achieved. Validates documentation, test coverage, vulnerability reporting process, and project hygiene.
Socket.dev
Supply chain protection on every PR touching package.json. Catches malicious packages, typosquatting, and obfuscated code before they reach the codebase.
DCO
Developer Certificate of Origin enforced on every commit. All contributors must sign off their changes.
Reporting a vulnerability
Do not open public GitHub issues for security vulnerabilities.
Public disclosure before a fix is available puts all users at risk.
Private GitHub Advisory
github.com/Fmarzochi/EGC/security/advisories/newResponse timeline
Scope
In scope
- scripts/
- mcp/servers/
- scripts/install.sh, scripts/install.ps1
- hooks/, skills/
Out of scope
- Third-party dependency vulnerabilities
- Issues requiring physical machine access
- DoS against local-only runtime
- Behaviors requiring write access to host