qoomb

OSPS-AC-01.01 — Compliant. Two-factor authentication is enforced at the GitHub organization level (COQOON-labs). All collaborators must complete MFA before accessing or modifying repository resources. This is configured in the organization's security settings and applies to all repositories under the organization.

OSPS-AC-02.01 — Compliant. The COQOON-labs GitHub organization's default repository permission is set to read, which is the lowest available privilege level. New collaborators automatically receive read-only access and must be explicitly granted elevated permissions (write, maintain, admin) on a per-repository basis. No manual configuration change is needed — this is the current organizational default.

OSPS-AC-03.01 — Compliant. The main branch has an active ruleset (ID 12610279) that includes a pull_request rule requiring 1 approving review, code owner review, review thread resolution, and dismissal of stale reviews on push. Additionally, required_status_checks (Code Quality, Commit Messages, Tests) must pass before merging. Direct commits to main are blocked — all changes must go through a pull request. Only Organization Admins and the Repository Admin role have bypass permissions, which is expected for a solo-maintainer project.

OSPS-AC-03.02 — Compliant. The main branch ruleset (ID 12610279) includes a deletion rule that explicitly prevents deletion of the primary branch. Any attempt to delete main is blocked by GitHub's enforcement mechanism, regardless of user permissions.

OSPS-AC-03.01 — Compliant (OSPS-BR-01.01). The project's CI/CD pipelines do not accept user-defined input parameters. The only workflow_dispatch trigger (in sbom.yml) has no custom inputs defined — it is a parameterless manual trigger. All ${{ }} expressions reference safe, platform-controlled contexts (github.workflow, github.ref, github.sha, secrets., steps., matrix.*). No expressions interpolate attacker-controllable values (such as github.event.pull_request.title or github.head_ref) into run: steps. The sole use of github.event.pull_request.title is in a safe if: condition (not a shell context), which is not vulnerable to injection.

Project URLs use HTTPS exclusively.

Distribution channels use HTTPS exclusively.

OSPS-BR-07.01 — Compliant. Multiple layers prevent unintentional storage of secrets in version control:

.gitignore excludes .env, .env*.local, certs, *.db, and other sensitive file patterns.
GitHub Secret Scanning is enabled at the organization/repository level, detecting committed credentials automatically.
Trivy secret scanner (trivy.yml) runs a dedicated secret scan type on every push and PR with exit-code: '1' — the pipeline fails if any secrets are detected.
Trivy filesystem scan additionally scans for vulnerabilities and misconfigurations in committed files.
CodeQL (codeql.yml) performs SAST analysis that can also flag hardcoded credentials in source code.

OSPS-DO-01.01 — Not Applicable (yet). The project has not made any release yet — it is at version 0.1.0 in pre-release development (Phase 1). This requirement only applies "when the project has made a release." No GitHub Releases or published packages exist. When the first release is published, user documentation covering installation, configuration, and usage will need to be created. Current documentation (README.md, SETUP.md, docs) covers developer setup but not end-user guides.

GitHub provides defect reporting mechanisms by default (via issues).

GitHub supports public discussions on proposed changes (via pull requests) and usage obstacles (via issues).

OSPS-GV-03.01 — Compliant. The project includes a CONTRIBUTING.md at the repository root that documents the full contribution process: prerequisites, development setup, fork & branch workflow, Conventional Commits format, pull request procedure, code standards enforcement (Prettier, ESLint, TypeScript, Commitlint, CodeQL, Trivy), project structure overview, and maintainer contact information. The CLA requirement is referenced with a link to LICENSE.md. A separate CONTRIBUTORS.md lists recognized contributors and links back to CONTRIBUTING.md.

License file found in repository.

Repository is publicly available on GitHub.

Repository git metadata is publicly available on GitHub.

OSPS-QA-04.01 — Not Applicable. Qoomb is a single monorepo (COQOON-labs/qoomb) with no external subproject repositories. All components — applications (api, web, mobile) and shared libraries (types, validators, ui, config, eslint-config) — reside within this repository and are managed as pnpm workspaces. There are no separate codebases compiled into the release. The project structure is documented in both README.md and claude.md.

OSPS-QA-05.02 — Compliant. The repository contains no unreviewable binary artifacts. All tracked files are human-readable source code (TypeScript, JSON, YAML, Markdown, SQL, shell scripts) or permissible assets (PNG/SVG icons for PWA). Build outputs (dist/, node_modules, .turbo) are excluded via .gitignore and never committed. No executable binaries, compiled libraries, or opaque archive files are present in version control.

OSPS-BR-01.02 — Compliant. Branch name references (github.ref, github.base_ref) are only used in safe contexts: concurrency.group keys for deduplication and an actions/checkout ref: parameter (version-check.yml:71). Neither is interpolated into a run: shell step where injection could occur. The concurrency.group context is a GitHub-platform construct that does not execute shell commands, and actions/checkout's ref input is handled internally by the action without shell interpolation. No branch names are used in shell scripts, run: blocks, or other injectable contexts.