t3x-rte_ckeditor_image

GitHub Actions workflows assign minimum necessary privileges per job. Workflow-level permissions: {} (none by default). Each job explicitly declares only required permissions (e.g., contents: read, security-events: write). Step-security/harden-runner monitors execution.

All release assets clearly associated with version identifier. GitHub Releases bundle source archives, SLSA provenance, and attestation files under the version tag. Composer package versioned consistently via Packagist.

Secrets Management section in SECURITY.md documents storage (GitHub Encrypted Secrets), access (admin-only), rotation policy (on team changes or compromise), prevention (.gitignore, harden-runner), and audit (GitHub audit log): https://github.com/netresearch/t3x-rte_ckeditor_image/blob/main/SECURITY.md

README.md 'Verifying Releases' section provides instructions for verifying SLSA provenance via gh attestation verify: https://github.com/netresearch/t3x-rte_ckeditor_image/blob/main/README.md

README.md 'Verifying Releases' section provides instructions for verifying GPG-signed tags and release author identity via git tag -v and git log --show-signature: https://github.com/netresearch/t3x-rte_ckeditor_image/blob/main/README.md

SECURITY.md 'Support Policy' section documents support scope and duration per version, including active support, security-only support, and end-of-life status: https://github.com/netresearch/t3x-rte_ckeditor_image/blob/main/SECURITY.md

SECURITY.md 'Support Policy' section states: 'When a TYPO3 LTS version reaches end of life, the corresponding extension version will no longer receive security updates.' Version-specific EOL status documented in support table: https://github.com/netresearch/t3x-rte_ckeditor_image/blob/main/SECURITY.md

CONTRIBUTING.md 'Permission escalation' section documents the review process: contribution history required, team member sponsorship, admin approval, audit logging: https://github.com/netresearch/t3x-rte_ckeditor_image/blob/main/CONTRIBUTING.md

PHP extension distributed as source code via Composer. No compiled release assets. Software bill of materials not applicable as there are no compiled binary releases — dependencies resolved at install time by Composer.

This is a single-project extension without subprojects. No subprojects exist to enforce security requirements upon.

Testing documentation in CONTRIBUTING.md, Makefile help target, and CI workflow files. Tests run on every push to main and all PRs via GitHub Actions. Test commands documented: composer ci:test:php:unit, composer ci:test:php:functional, npm test.

PR template (.github/pull_request_template.md) requires test plan for all contributions. CI enforces test execution. Recent changes demonstrate policy adherence with test additions for major features (visible in CHANGELOG.md).

Threat model documented in Documentation/Architecture/Threat-Model.md covering 7 identified threats (XSS, SSRF, CSS injection, protocol injection, privilege escalation, ReDoS, SVG XSS), trust boundaries, and mitigations for all critical code paths: https://github.com/netresearch/t3x-rte_ckeditor_image/blob/main/Documentation/Architecture/Threat-Model.md

VEX document at vex.json tracks non-affecting vulnerabilities in OpenVEX format. CVE-2025-45769 (firebase/php-jwt) documented as not_affected with justification vulnerable_code_not_in_execute_path: https://github.com/netresearch/t3x-rte_ckeditor_image/blob/main/vex.json

SECURITY.md defines vulnerability response SLAs: 48-hour acknowledgment, 7-day critical fix. Dependency Review action blocks PRs with high-severity CVEs. Dependabot (daily checks) and Renovate (auto-merge minor/patch) enforce continuous remediation thresholds.

CI pipeline runs Dependency Review action on all PRs to detect SCA violations before merge. Composer audit configured to track known vulnerabilities. High-severity CVEs block PR acceptance.

Dependency Review GitHub Action automatically evaluates all codebase changes against known vulnerability databases. Dependabot alerts for new CVEs. Renovate auto-updates dependencies to patched versions.

PHPStan at level 10 (strictest) fails CI on any new violation — effectively a zero-tolerance SAST policy. CodeQL analysis runs on every push and PR. PHPStan baseline (phpstan-baseline.neon) tracks known exclusions with documented justifications.

CodeQL and PHPStan automatically evaluate all codebase changes on every push and PR. Both tools fail the CI pipeline on detection of security weaknesses. Weekly scheduled CodeQL scans provide additional coverage.