bridgewatch

The source is in a public git repository on GitHub. https://github.com/distronode-corporation/bridgewatch

Git records every change with its author, date and message, browsable at https://github.com/distronode-corporation/bridgewatch/commits/main

Development happens on main in the public repository, through pull requests; every commit between releases is public, not just release snapshots. https://github.com/distronode-corporation/bridgewatch/pulls?q=

The project uses git.

Each release has a unique version (0.1.0, 1.0.0, 1.1.0). scripts/check-version.py checks that Cargo.toml and package.json agree, and release.yml refuses a tag whose version disagrees with them or whose commit is not on main; a ruleset forbids moving or deleting release tags. https://github.com/distronode-corporation/bridgewatch/blob/main/.github/workflows/release.yml

The project adheres to Semantic Versioning, as CHANGELOG.md states. https://github.com/distronode-corporation/bridgewatch/blob/main/CHANGELOG.md

Each release is a vX.Y.Z git tag, and release.yml builds a release only from such a tag. https://github.com/distronode-corporation/bridgewatch/tags

Each release has human-readable release notes in CHANGELOG.md (Keep a Changelog format), and release.yml uses the matching section verbatim as the GitHub Release body. https://github.com/distronode-corporation/bridgewatch/blob/main/CHANGELOG.md and https://github.com/distronode-corporation/bridgewatch/releases

There have been no publicly known vulnerabilities in the project's own code (0 repository advisories). SECURITY.md commits to crediting reporters in the changelog entry for each fix.

Bugs are reported as GitHub issues through the bug report form; CONTRIBUTING.md says what to include (the output of bridgewatch check --json, which contains no token, and the pipeline id). https://github.com/distronode-corporation/bridgewatch/blob/main/CONTRIBUTING.md and https://github.com/distronode-corporation/bridgewatch/blob/main/.github/ISSUE_TEMPLATE/bug_report.yml

The project uses GitHub Issues. https://github.com/distronode-corporation/bridgewatch/issues

No bug reports have been received from users yet (the one issue, #25, is the maintainer's own tracking issue); the maintainer watches the issue tracker and will acknowledge each report.

No enhancement requests have been received yet; ideas go to GitHub Discussions and are answered there.

All issues, pull requests and discussions, open and closed, stay publicly searchable on GitHub. https://github.com/distronode-corporation/bridgewatch/issues?q=

SECURITY.md describes how to report a vulnerability, what to include, the security model, what is in and out of scope, and what bridgewatch sends where. https://github.com/distronode-corporation/bridgewatch/blob/main/SECURITY.md

Private reports go through GitHub private vulnerability reporting (enabled), with email to opensource@distronode.com as a fallback, as SECURITY.md describes. https://github.com/distronode-corporation/bridgewatch/security/advisories/new

No vulnerability reports have been received in the last 6 months. SECURITY.md promises an acknowledgement within a few working days.

npm ci then npm run tauri build builds the GUI from source, and cargo install --locked --path crates/bridgewatch-cli the CLI; the README's "Build from source" and "CLI" sections list the platform packages and commands, and CI builds and checks the workspace on every push and pull request. https://github.com/distronode-corporation/bridgewatch#readme

The build uses Cargo, npm, Vite and the Tauri CLI, the common tools for a Rust and TypeScript desktop app.

Rust, Cargo, Node.js, npm, Vite, Svelte and the Tauri CLI are all FLOSS, and the Linux packages build with FLOSS tools only. (The macOS bundle also needs Apple's Command Line Tools, which only that platform requires.)

The Rust tests (588 passed on the Ubuntu job of CI run 40112992195, against recorded real-pipeline fixtures and scripted transports, with no network or token) and the vitest frontend tests (27 files) are in the repository under Apache-2.0. https://github.com/distronode-corporation/bridgewatch/tree/main/crates/bridgewatch-core/tests

cargo test --workspace and npx vitest run run the suites, the standard invocations for Rust and for a Vite project.

GitHub Actions runs the whole gate on every push to main and every pull request, on Ubuntu 22.04 x86_64 and arm64 and macOS, plus an MSRV check, cargo-deny and zizmor. https://github.com/distronode-corporation/bridgewatch/blob/main/.github/workflows/ci.yml

CONTRIBUTING.md sets the policy: a change in behaviour comes with a test that fails without it, cargo test for Rust and vitest for the frontend; verdict-rule changes add a recorded fixture and config keys add parity tests. https://github.com/distronode-corporation/bridgewatch/blob/main/CONTRIBUTING.md#commits-and-pull-requests

Major new functionality ships with its tests: GitHub Actions support (1.0.0) added tests/github.rs and tests/github_group.rs, and OAuth sign-in added tests/oauth.rs and tests/oauth_log.rs. https://github.com/distronode-corporation/bridgewatch/tree/main/crates/bridgewatch-core/tests

The test policy is written in CONTRIBUTING.md (a change in behaviour comes with a test that fails without it), and pull requests are held to it at review. https://github.com/distronode-corporation/bridgewatch/blob/main/CONTRIBUTING.md#commits-and-pull-requests

Clippy runs over every target with -D warnings, TypeScript runs in strict mode (tsconfig.json), svelte-check checks the components, and the test setup fails any test in which Svelte prints a derived_inert warning. https://github.com/distronode-corporation/bridgewatch/blob/main/tsconfig.json and https://github.com/distronode-corporation/bridgewatch/blob/main/.github/workflows/ci.yml

cargo clippy --workspace --all-targets --locked -- -D warnings runs in CI on every push and pull request, so any rustc or clippy warning fails the job, and tsc and svelte-check errors fail the frontend job.

Every rustc and clippy warning is an error (-D warnings) on all targets including tests, and TypeScript runs with strict.

The primary developer designed the software around these principles, as SECURITY.md's security model shows: tokens never in the config file and redacted in memory, no redirects followed with credentials, writes off by default, confirmation before a command token source or a credential moves to a new host, links opened only to configured hosts, web views with almost no capabilities, and a sandboxed verdict script engine. https://github.com/distronode-corporation/bridgewatch/blob/main/SECURITY.md

The primary developer knows the common error classes for this kind of software and their mitigations; SECURITY.md's scope lists them: token leaks to files, logs or other hosts, credential forwarding on redirects, argument or shell injection, open redirects in the link opener, script sandbox escape, template injection, skippable TLS verification and permissive file modes. https://github.com/distronode-corporation/bridgewatch/blob/main/SECURITY.md

The only cryptography is TLS (rustls through reqwest) and the OAuth 2.0 device authorization grant (RFC 8628), both published, reviewed protocols; tokens are kept in the OS credential store.

bridgewatch implements no cryptography; it calls rustls for TLS and the OS keychain or Secret Service for credential storage.

rustls and its providers (ring, aws-lc-rs) are FLOSS, and the Linux Secret Service implementations are FLOSS.

rustls supports only TLS 1.2 and 1.3 with 128-bit or stronger AEAD cipher suites and rejects RSA keys under 2048 bits; certificate verification is always on, with no option to turn it off.

No broken algorithm or mode is used: rustls implements no MD5, SHA-1 signatures, single DES, RC4 or CBC suites, and the project uses none itself.

No algorithm with known serious weaknesses is used; rustls offers only modern AEAD suites.

rustls offers only forward-secret key exchange (ECDHE in TLS 1.2, and TLS 1.3, which is always forward secret).

bridgewatch does not authenticate users with passwords; it is a client that holds API tokens for GitLab and GitHub (outbound authentication) in the OS credential store.

bridgewatch generates no cryptographic keys or nonces: OAuth uses the device grant, which has no client secret or PKCE verifier, and the confirmation and sign-in ids are handles returned to the caller, not secrets. TLS randomness comes from rustls's CSPRNG.

Releases are delivered only over HTTPS from GitHub Releases; the macOS .dmg is Developer ID signed and notarised, and every asset carries a signed GitHub build provenance attestation, attached as bridgewatch_<version>.intoto.jsonl and checked with gh attestation verify. https://github.com/distronode-corporation/bridgewatch/blob/main/.github/workflows/release.yml

The project publishes no bare checksum files; integrity is checked against the signed provenance attestation (and the macOS code signature), fetched over HTTPS.

There are no unpatched publicly known vulnerabilities: 0 repository advisories and 0 open Dependabot alerts. cargo-deny checks RustSec on every push, pull request and weekly; the RustSec notices it allows are unmaintained or unsound notices with no fixed version (not CVSS-rated vulnerabilities), each listed by id with a reason in deny.toml. https://github.com/distronode-corporation/bridgewatch/blob/main/deny.toml

Dependabot security updates are enabled, cargo-deny and npm audit --audit-level=high run weekly (audit.yml), and SECURITY.md states that fixes ship in a new release. https://github.com/distronode-corporation/bridgewatch/blob/main/.github/workflows/audit.yml

The repository holds no valid private credentials: the signing identity and notary key are GitHub encrypted secrets used only by release.yml, fixtures are scrubbed through an allow-list that a test enforces, and GitHub secret scanning with push protection is on and has 0 open alerts.

CodeQL (default setup) analyses the Rust, JavaScript/TypeScript, Python and Actions code on pushes, pull requests and weekly; clippy runs on every change; zizmor statically analyses the workflows and cargo-deny checks dependencies on every push and pull request. https://github.com/distronode-corporation/bridgewatch/blob/main/.github/workflows/ci.yml

CodeQL's security queries look for common vulnerabilities (cleartext logging of secrets, injection, path traversal, insecure TLS), and zizmor looks for workflow injection and over-broad tokens.

There are no open CodeQL alerts (read 2026-10-24): 15 were fixed, and 12 rust/cleartext-logging alerts were dismissed with a written reason (test-only assertion messages, or output that holds no secret). Medium and higher findings are fixed or dismissed with a recorded reason. (GitHub shows the code-scanning list to maintainers only, so it is not linked.)

CodeQL runs on pushes to main and on pull requests (plus weekly), and clippy and zizmor on every push and pull request.

bridgewatch is written in Rust and TypeScript, and every Rust crate declares #![forbid(unsafe_code)]; the repository contains no C or C++.

cargo test builds the debug profile, where debug_assert! checks and integer overflow checks are on, and the vitest setup turns Svelte's derived_inert warning into a test failure.

No medium or higher vulnerability has been found by dynamic analysis; a failing test blocks the required CI checks, so a finding is fixed before the change can merge.