bestax

The project provides a documented upgrade path rather than maintaining old lines. Supported versions are stated explicitly in https://github.com/allxsmith/bestax/blob/main/SECURITY.md (latest release line per package), semantic versioning driven by Conventional Commits means a major bump is the signal that an upgrade needs attention, and every breaking change is recorded with its BREAKING CHANGE note in the per-package CHANGELOG and GitHub Release. Migration guides live at https://bestax.io/docs/guides/getting-started/migration, and the project additionally ships a codemod, bestax-migrate, that performs the mechanical parts of an upgrade automatically.

The project uses the GitHub issue tracker for individual issues, with labels, templates and automated triage: https://github.com/allxsmith/bestax/issues

No vulnerabilities have been reported or resolved in this project in the last 12 months, so there is no reporter to credit. The published policy commits to crediting reporters in the release notes or advisory unless they request anonymity: https://github.com/allxsmith/bestax/blob/main/SECURITY.md

The response process is documented at https://github.com/allxsmith/bestax/blob/main/SECURITY.md - reports arrive by email to security@bestax.io or as a GitHub private security advisory; acknowledgement within 48 hours; triage and confirmation within 7 days; if accepted, a fix and a coordinated disclosure timeline agreed with the reporter; if declined, an explanation of why; credit to the reporter unless anonymity is requested; and publication of a GitHub Security Advisory once resolved. Because all packages release automatically from main, the fix ships as soon as it merges.

The style guides are identified and required. Formatting is Prettier (the project's Prettier configuration is the style guide of record, and it is pinned so formatting stays deterministic); lint rules are the ESLint flat config at https://github.com/allxsmith/bestax/blob/main/eslint.config.js, composed of eslint:recommended, typescript-eslint, eslint-react, react-hooks, storybook and prettier; commit messages follow Conventional Commits per https://github.com/allxsmith/bestax/blob/main/commitlint.config.js. Compliance is required of contributions by https://github.com/allxsmith/bestax/blob/main/CONTRIBUTING.md#code-quality-standards

Enforcement is automatic, not advisory: pnpm lint (ESLint) and pnpm format:check (Prettier) run in CI on every push and pull request and must pass before merge, commitlint runs on the husky commit-msg hook and again on pull request titles, and pnpm check:conformance enforces the additional house conventions. All of these are FLOSS tools.

The project produces no native binaries - all output is JavaScript, TypeScript declarations and CSS - so there are no CC, CFLAGS, CXX, CXXFLAGS or LDFLAGS variables for the build to honor.

There is no native compilation and so no debug-symbol option to preserve. The published JavaScript is not stripped of anything a debugger needs, and consumers debug against readable, typed output plus the TypeScript declarations shipped in each package.

The build is not a recursive make. It is a single Turborepo task graph over the workspace (pnpm build), which resolves all inter-package dependencies in one pass from the root.

Builds are deterministic and repeatable. Dependencies resolve from a committed pnpm lockfile installed with --frozen-lockfile against a pinned pnpm version and a pinned Node major, and the compilers (tsc, Vite/Rollup, Sass) emit output determined only by their inputs and configuration - the generation checks in CI depend on exactly this property: pnpm gen:api-docs:check, gen:catalog:check and gen:mcp:check regenerate artifacts and fail the build on any byte-level difference from what is committed.

Installation and removal use the ordinary JavaScript convention: npm install @allxsmith/bestax-bulma (or pnpm/yarn add) to install, npm uninstall to remove, and npm create bestax@latest my-app to scaffold. Nothing is written outside the consuming project's node_modules, and no install scripts run. Documented in the README quick start and at https://bestax.io/docs/guides/getting-started/installation

There is no separate installation system to parameterize - the npm client places packages according to its own standard conventions inside the consuming project, and the project neither writes files elsewhere nor defines an install path, so DESTDIR and similar variables do not apply.

A developer gets the whole workspace running with git clone, pnpm install and pnpm build - all four packages, the docs site and Storybook. The steps, plus how to run the docs site (pnpm docs), Storybook (pnpm storybook), the full CI suite locally (pnpm all) and a throwaway scaffolded app, are documented at https://github.com/allxsmith/bestax/blob/main/CONTRIBUTING.md#setting-up--running-the-project

External dependencies are listed in computer-processable form in the per-package package.json files and resolved exactly by the committed lockfile: https://github.com/allxsmith/bestax/blob/main/pnpm-lock.yaml and https://github.com/allxsmith/bestax/blob/main/bulma-ui/package.json. The library ships a single runtime dependency (Bulma v1); icon libraries are optional peer dependencies. A machine-readable SBOM is additionally generated for every release by https://github.com/allxsmith/bestax/blob/main/.github/workflows/supply-chain.yml

Dependencies are monitored continuously and from several directions: Dependabot opens weekly grouped update pull requests, the dependency-review workflow blocks any pull request that introduces a dependency with a known advisory, the Socket.dev GitHub App reviews every dependency change for malware and install scripts, pnpm audit runs at high severity, and a 3-day minimumReleaseAge cooldown keeps just-published releases out. The only two accepted advisory bypasses are transitive Docusaurus build-time packages with no patched version available - both verified as not reachable from published code, and both carrying a dated review marker that fails CI when it expires. See https://github.com/allxsmith/bestax/blob/main/SECURITY.md

All reused components are ordinary npm dependencies declared in package.json and pinned by the lockfile - there are no vendored or convenience copies anywhere in the tree - so updating one is a version bump plus pnpm install, which is what Dependabot automates weekly. The published library reuses exactly one runtime component, Bulma v1, on a caret range so consumers pick up its patches.

The stack is current and free of deprecated APIs: React function components with hooks only (no legacy class lifecycle, no legacy context, no findDOMNode), React 19 with a CI matrix that also proves React 18 compatibility, ESLint flat config, ES modules throughout, Bulma v1, and TypeScript 6. eslint-react and react-hooks rules flag deprecated React usage, and the typecheck catches removed APIs on every dependency upgrade.

The full automated suite runs on every push and pull request to main and reports pass or fail as a required GitHub status check: build, typecheck, unit tests, coverage, bundle stats, lint, format check and conformance checks, plus a React 18/19 compatibility matrix and Playwright end-to-end scaffolding runs. See https://github.com/allxsmith/bestax/blob/main/.github/workflows/ci.yml and the checks on any pull request at https://github.com/allxsmith/bestax/pulls

Well over half of the bugs fixed in the last six months came with a regression test in the same pull request; the 99% coverage gate on bulma-ui makes it very difficult to merge a fix without one, and CONTRIBUTING.md requires unit tests for bug fixes as well as features. See merged fix commits at https://github.com/allxsmith/bestax/pulls?q=is%3Apr+is%3Amerged+fix

Statement coverage is enforced above 80% by jest, a FLOSS tool, and the build fails below it: 99% statements (and branches, functions, lines) for bulma-ui per https://github.com/allxsmith/bestax/blob/main/bulma-ui/jest.config.js, and 95% for every other jest package. pnpm test:coverage runs on every push and pull request in CI.

The written policy is in the contribution requirements: all tests must pass and per-package coverage thresholds must be met for a pull request to be accepted, and unit tests are required for all new features and bug fixes - https://github.com/allxsmith/bestax/blob/main/CONTRIBUTING.md#code-quality-standards. Because coverage is a hard gate in CI rather than a request, adding functionality without tests fails the build.

The policy is documented in the contribution instructions - https://github.com/allxsmith/bestax/blob/main/CONTRIBUTING.md#development-workflow step 5 (update/add unit tests, coverage must stay above the threshold) - and repeated as a checklist item in the pull request template: https://github.com/allxsmith/bestax/blob/main/.github/pull_request_template.md

TypeScript strict mode is on repository-wide with noUnusedLocals, ESLint runs recommended plus React, react-hooks, Storybook and Prettier rule sets, and additional house rules are enforced by pnpm check:conformance (documentation and story coverage, SCSS patterns, an inline-style ratchet, and expiry dates on every supply-chain bypass).

The secure design principles named in know_secure_design are implemented where they apply. Least privilege: every workflow defaults to contents: read, the release job re-declares only the scopes it needs, and the release App token is scoped to three permissions on one repository and expires within the hour. No long-lived secrets: npm publishing uses OIDC trusted publishing, so there is no NPM_TOKEN to steal. Fail closed: the inbound security triage flags rather than passes when it errors, and it holds no write-capable credentials so an injected scan cannot write to the repository. Limited attack surface in the produced software: the library performs no network access, no persistence and no dynamic code evaluation, renders through React's escaping rather than raw HTML, and ships a single runtime dependency. Defence in depth around changes: protected main, required human review, layered automated review, dependency review, Socket.dev, and CodeQL. See https://github.com/allxsmith/bestax/blob/main/SECURITY.md

This project produces a React UI component library, a project scaffolder, a codemod and an MCP server. None of them include, activate, enable or call cryptographic functionality, and none store passwords or generate keys or nonces, so this criterion is not applicable. Transport security for distribution and the docs site is provided by HTTPS, which is covered under delivery_mitm and sites_https. This project produces a React UI component library, a project scaffolder, a codemod and an MCP server. None of them implement, call, configure or process cryptography, credentials, private keys or network connections of their own, so this criterion is not applicable. Transport security for distribution and the documentation site is provided by HTTPS and is covered under delivery_mitm and sites_https.

This project produces a React UI component library, a project scaffolder, a codemod and an MCP server. None of them implement, call, configure or process cryptography, credentials, private keys or network connections of their own, so this criterion is not applicable. Transport security for distribution and the documentation site is provided by HTTPS and is covered under delivery_mitm and sites_https.

This project produces a React UI component library, a project scaffolder, a codemod and an MCP server. None of them implement, call, configure or process cryptography, credentials, private keys or network connections of their own, so this criterion is not applicable. Transport security for distribution and the documentation site is provided by HTTPS and is covered under delivery_mitm and sites_https.

This project produces a React UI component library, a project scaffolder, a codemod and an MCP server. None of them implement, call, configure or process cryptography, credentials, private keys or network connections of their own, so this criterion is not applicable. Transport security for distribution and the documentation site is provided by HTTPS and is covered under delivery_mitm and sites_https.

This project produces a React UI component library, a project scaffolder, a codemod and an MCP server. None of them implement, call, configure or process cryptography, credentials, private keys or network connections of their own, so this criterion is not applicable. Transport security for distribution and the documentation site is provided by HTTPS and is covered under delivery_mitm and sites_https.

This project produces a React UI component library, a project scaffolder, a codemod and an MCP server. None of them implement, call, configure or process cryptography, credentials, private keys or network connections of their own, so this criterion is not applicable. Transport security for distribution and the documentation site is provided by HTTPS and is covered under delivery_mitm and sites_https.

This project produces a React UI component library, a project scaffolder, a codemod and an MCP server. None of them implement, call, configure or process cryptography, credentials, private keys or network connections of their own, so this criterion is not applicable. Transport security for distribution and the documentation site is provided by HTTPS and is covered under delivery_mitm and sites_https.

Every release is cryptographically signed. Each published tarball carries a signed npm provenance attestation (Sigstore) binding it to the exact source commit and CI run that produced it, minted by the release workflow with OIDC trusted publishing rather than a long-lived token; consumers verify with npm audit signatures, and the attestation is shown in the Provenance section of each npm package page. The corresponding git release tag and chore(release) commit are signed as well, and main rejects unsigned commits. See https://github.com/allxsmith/bestax/blob/main/SECURITY.md

Release tags are cryptographically signed. main rejects unsigned commits, and semantic-release pushes its chore(release) commit and the accompanying per-package tag through a GitHub App whose writes are signed, so every release tag in https://github.com/allxsmith/bestax/tags carries a verified signature. See the Protected main and npm provenance sections of https://github.com/allxsmith/bestax/blob/main/SECURITY.md

Untrusted input is identified and restricted to what is expected at each entry point. The library's inputs are component props, which are constrained by exported TypeScript types checked at consumer build time, narrowed to enumerated unions wherever Bulma allows only a fixed set of values, and rendered as text through React's escaping - the components never evaluate code and never inject raw HTML on the caller's behalf. bestax-mcp validates every tool call against a declared zod schema before acting on it. create-bestax validates project names and its flag values (template, CSS flavor, icon set) against known-good sets before touching the filesystem. bestax-migrate operates on a parsed AST rather than on text substitution. The prop contracts are documented per component at https://bestax.io/docs/api

Hardening is applied where it can be: the produced software is written entirely in memory-safe TypeScript/JavaScript, uses no eval or dynamic code construction, injects no raw HTML, requests no network or storage access, and is therefore compatible with a strict Content-Security-Policy in the consuming application. Build and release are hardened as well - read-only default tokens, SHA-pinned actions, blocked dependency install scripts, isolated node_modules, a frozen lockfile, and short-lived OIDC credentials. The documentation site and repository are served over HTTPS by Cloudflare and GitHub. See https://github.com/allxsmith/bestax/blob/main/SECURITY.md

CodeQL is exactly such a tool: its JavaScript/TypeScript security query suites look for common vulnerability classes in this language and environment (injection, XSS, unsafe deserialization, path traversal, and more), and it also scans the GitHub Actions workflows for common CI/CD weaknesses.

The project produces no software written in a memory-unsafe language. All source is TypeScript, JavaScript and SCSS, running on the JavaScript engine of a browser or Node.js.