kotiko

Every workflow sets top-level permissions to contents: read or none, and each job asks only for what it needs: release-please writes the release branch and pull request, attest gets id-token and attestations write, the GitHub release job writes contents, the store-status job writes contents to edit release notes, Pages deploy gets pages and id-token; all other jobs read only.

The only workflow with collaborator inputs is the manual evaluation run: its inputs are passed as environment variables and quoted, never expanded into the script, and the script's parser rejects unknown options, converts the budget to a number, accepts only known case sets, and uses model names only as JSON values and, with slashes and colons replaced, as file names. The release and store-status manual runs take no inputs.

Each release has its own SemVer version (0.1.0, 0.2.0, next 1.0.0), kept identical in the server, the extension manifest and the release manifest; CI fails if they differ. [version_unique]

docs/stores.md "Secrets" is the policy: every credential belongs to the organization's accounts, not a person's; each is stored only as a GitHub environment secret (release, store-status, eval) with the narrowest scope available, release secrets reachable only from v* tags after maintainer approval; workflows never print them; rotation at least yearly and whenever someone with access leaves, by organization owners, with the steps. Secrets never go in the repository (CONTRIBUTING.md). https://github.com/ScriptKittyOS/kotiko/blob/main/docs/stores.md#secrets

No release has been made yet; the first public release will be v1.0.0. SECURITY.md already states that only the latest minor release gets security fixes; a fuller support statement (what support each release gets and for how long) will be published before that release.

SECURITY.md "Supported versions": only the latest minor release gets security fixes, so a version stops receiving security updates as soon as a newer minor version is released. https://github.com/ScriptKittyOS/kotiko/blob/main/SECURITY.md#supported-versions

GOVERNANCE.md: escalated access (maintainer, which carries admin, merge and release rights) requires at least three months of sustained good contribution, nomination by a maintainer, no objection from the other maintainers within 7 days, and a reviewed pull request to MAINTAINERS.md; the kotiko-maintainers team holds exactly the people listed there, and access is removed the day someone steps down or goes inactive. https://github.com/ScriptKittyOS/kotiko/blob/main/GOVERNANCE.md

Every release includes a CycloneDX SBOM of the server's production dependencies (kotiko-server-X.Y.Z.cdx.json), generated at build time by the sbom Mix tool and attested with the other files. The extension zips are uncompiled first-party source with no third-party code. No release has been published yet.

Kotiko is a single repository; there are no subproject repositories in a release.

CONTRIBUTING.md "Setup" and "Tests" and the developer setup page explain how to run each suite locally (mix test; npm test for unit, DOM and background tests; npm run e2e for end-to-end; the site's own tests), what each covers, and that CI runs them on every pull request and on main, listed in .github/workflows/ci.yml. https://github.com/ScriptKittyOS/kotiko/blob/main/CONTRIBUTING.md#tests

CONTRIBUTING.md, Tests: every pull request that adds or changes behaviour adds or updates automated tests in the same pull request, and major new functionality is not merged without tests. https://github.com/ScriptKittyOS/kotiko/blob/main/CONTRIBUTING.md#tests [test_policy_mandated]

docs/security/assurance-case.md: the top claim and its sub-claims mapped to arguments and evidence, the threat model (assets, attackers and what each can reach), the trust boundaries (diagram and table), how each secure design principle is applied, the CWE Top 25 and OWASP Top 10 weaknesses that apply and how each is countered, every input and how it is validated, and the residual risks. https://github.com/ScriptKittyOS/kotiko/blob/main/docs/security/assurance-case.md [assurance_case]

Dependabot alerts and security updates are on, with weekly version updates for Mix, npm and GitHub Actions, and CI runs mix hex.audit and mix deps.audit on every pull request. The open alerts on 2026-10-06 are all in development-only npm tools, never shipped: shell-quote and postcss-selector-parser have fixes in an open pull request, and node-forge (pulled in by web-ext's Android debugging library, no patched version yet) is reached only when web-ext debugs on Android over adb, which Kotiko's scripts never do (they run web-ext lint and sign), so it is not exploitable here. [dependency_monitoring]

Dependabot alerts and security updates are on, with weekly version updates for Mix, npm and GitHub Actions, and CI runs mix hex.audit and mix deps.audit on every pull request. The open alerts on 2026-10-06 are all in development-only npm tools, never shipped: shell-quote and postcss-selector-parser have fixes in an open pull request, and node-forge (pulled in by web-ext's Android debugging library, no patched version yet) is reached only when web-ext debugs on Android over adb, which Kotiko's scripts never do (they run web-ext lint and sign), so it is not exploitable here. [dependency_monitoring]

Dependabot alerts and security updates are on, with weekly version updates for Mix, npm and GitHub Actions, and CI runs mix hex.audit and mix deps.audit on every pull request. The open alerts on 2026-10-06 are all in development-only npm tools, never shipped: shell-quote and postcss-selector-parser have fixes in an open pull request, and node-forge (pulled in by web-ext's Android debugging library, no patched version yet) is reached only when web-ext debugs on Android over adb, which Kotiko's scripts never do (they run web-ext lint and sign), so it is not exploitable here. [dependency_monitoring]

No static analysis finding is open: CI fails on any, and pull requests are merged only when CI passes. None so far was an exploitable vulnerability. [static_analysis_fixed]

Credo (Elixir), ESLint with eslint-plugin-no-unsanitized and web-ext lint (JavaScript and the extension), ShellCheck (shell) and gitleaks (secrets) run on every push and pull request, so on every release candidate, and main accepts only pull requests that pass them. [static_analysis]