cortex-viz

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

Every change is merged to main as its own commit between releases, so main always carries interim work. Ten tags (v2.2.1 through v2.7.1) against a much longer commit history.

Repository on GitHub, which uses git. git is distributed.

Semantic version in pyproject.toml (currently 2.7.1), matching an annotated git tag and a GitHub Release per version.

Semantic Versioning: v2.2.1 through v2.7.1.

Every release has a matching vX.Y.Z git tag: https://github.com/cdeust/cortex-viz/tags

Non-trivial release notes file in repository: https://github.com/cdeust/cortex-viz/blob/main/CHANGELOG.md.

No release of cortex-viz has yet fixed a vulnerability that had a CVE or equivalent public assignment at the time the release was cut, so there is nothing of this kind to have omitted. The process that would record one is written down: SECURITY.md commits to public disclosure in the advisory and the release notes after a fix ships. https://github.com/cdeust/cortex-viz/blob/main/SECURITY.md

Non-trivial SECURITY[.md] file found file in repository: https://github.com/cdeust/cortex-viz/blob/main/SECURITY.md. [osps_do_02_01]

GitHub Issues is used for bug tracking and for enhancement requests, publicly and searchably, with every issue in the last six months resolved and closed. https://github.com/cdeust/cortex-viz/issues

Reports are responded to. Every issue opened in the last six months (#13, #17, #23, #31, #32, #35, #36, #37, #41) received a response and all nine were resolved and closed; none was left unacknowledged.

Enhancement requests get an explicit answer rather than silence. #37 (supply chain) and #35 (JS test harness) were accepted and implemented; PyPI Trusted Publishing was proposed inside #37 and explicitly declined with the reason recorded in release.yml, namely that cortex-viz has no PyPI project and the install path is the plugin marketplace. docs/ROADMAP.md carries a 'Not planned' section for the same purpose.

Public, searchable, permanently addressable: https://github.com/cdeust/cortex-viz/issues?q=is%3Aissue

SECURITY.md: do not open a public issue, open a private GitHub security advisory, with the affected version or commit, reproduction steps, and impact. https://github.com/cdeust/cortex-viz/blob/main/SECURITY.md

Private GitHub security advisory, which is a private channel between reporter and maintainer: https://github.com/cdeust/cortex-viz/security/advisories/new. Documented in https://github.com/cdeust/cortex-viz/blob/main/SECURITY.md

No vulnerability report has been received in the last six months, so there is no response time to report against. The commitment is now written down rather than implied: SECURITY.md, 'What happens next', promises initial acknowledgement within 14 days and assessment within 30 days of acknowledgement, with an email escalation path if 14 days pass unanswered. https://github.com/cdeust/cortex-viz/blob/main/SECURITY.md

PEP 517 build with hatchling, declared in pyproject.toml; python -m build produces the wheel and sdist. The release workflow runs exactly that, so the build is automated and reproducible from a clean checkout: https://github.com/cdeust/cortex-viz/blob/main/.github/workflows/release.yml

hatchling and python -m build, the standard PEP 517 toolchain. npm plus vitest for the browser test harness.

hatchling, build, pytest, vitest, Stryker, ruff, uv, CycloneDX are all FLOSS.

Two FLOSS suites, both public and both required in CI: pytest under tests/ (431 passed, 1 skipped on 2026-07-28) and vitest plus jsdom under tests/js/ (175 passed). How to run them is in CONTRIBUTING.md and in https://github.com/cdeust/cortex-viz/blob/main/.github/workflows/ci.yml

python -m pytest and npm test. Documented in https://github.com/cdeust/cortex-viz/blob/main/CONTRIBUTING.md#running-the-suites

CI runs both suites on every push and every pull request; the js-test job is required, so a failing JS test fails the build exactly like a failing pytest. https://github.com/cdeust/cortex-viz/blob/main/.github/workflows/ci.yml

CONTRIBUTING.md: 'As major new functionality is added, tests for that functionality MUST be added to the automated test suite in the same pull request', and a bug fix requires a regression test that fails on the pre-fix code. https://github.com/cdeust/cortex-viz/blob/main/CONTRIBUTING.md

Evidence from the most recent major changes. #35 added the entire vitest and jsdom harness for the 26k-line browser UI and wired it into CI as a required job. #36 shipped the coverage-honesty feature with its verdict logic as a pure, mutation-gated seam where every emission including the quiet complete state is asserted by tests. #41's file split was behaviour-preserving under the existing suite. See https://github.com/cdeust/cortex-viz/blob/main/CHANGELOG.md

The requirement, the command for each suite, and the standard tests are judged by are all in CONTRIBUTING.md, including that strength is measured by mutation rather than line coverage, with the Stryker configuration in stryker.conf.json and surviving mutants triaged in tests/js/MUTATION_NOTES.md. https://github.com/cdeust/cortex-viz/blob/main/CONTRIBUTING.md

CodeQL with the security-and-quality query suite runs on both languages (python and javascript-typescript) on every push, every pull request, and a weekly cron. That suite is a code-quality linter as well as a security scanner: its output on this repository includes unused imports, unused locals, empty except blocks, useless assignments, and trivial conditionals. https://github.com/cdeust/cortex-viz/blob/main/.github/workflows/codeql.yml

Answered against this criterion's own stated tolerance, which allows a project to accept fewer than 1 warning per 100 lines. CodeQL reports 182 open alerts across 59,324 analysed source lines (32,935 Python plus 26,389 JavaScript), which is 0.31 per 100 lines, measured 2026-07-28. The honest qualifier: this backlog has not yet been triaged item by item, because CodeQL only landed on 2026-07-25 with issue #37. Roughly 150 are note-level quality findings; the 12 high and 9 error-level alerts are being worked first and are NOT being left to the ratio. Full triage, with each alert either fixed or dismissed with a written reason, is tracked in https://github.com/cdeust/cortex-viz/issues/46

Maximally strict where practical, enforced by a required CI job. The lint job in .github/workflows/ci.yml runs ruff check and ruff format --check over the whole tree on every push and pull request; js-lint runs ESLint over ui/. The Python rule set is wider than ruff's default: [tool.ruff.lint].select is E, W, F, I, N, UP, B, C4, SIM, RUF (pyproject.toml). --select ALL is deliberately NOT the target — it reports 6,369 findings here, dominated by docstring-style (D), annotation-completeness (ANN) and assert-in-test (S101) rules that would be answered with a blanket ignore, which is a preference dressed as a gate. Two rules are ignored with the reason written at the ignore: RUF100, because under a curated select it deletes suppressions for rules the set does not enable (it removed 52 of the 60 it flagged, incl. 4 security ones), and SIM105, because ruff's own fixer withholds it at all 42 sites here — every one carries the named failure mode as a comment, which the rewrite would erase. Note on the earlier figure: the 486 violations cited before were measured with ruff's PREVIEW rules enabled, not the defaults; on stable rules the tree passed then and now. The real gate cost was 386 findings under the widened set, all cleared. Closed by https://github.com/cdeust/cortex-viz/issues/45

Demonstrated in the code and in a written argument rather than asserted. cortex_viz/server/http_security.py implements DNS-rebinding, CORS, header-splitting, and CSRF defenses, each with the CWE it counters named in the docstring (CWE-346/350, CWE-942, CWE-113, CWE-352). The design principles applied (least privilege, economy of mechanism, fail-safe defaults, complete mediation, defence in depth, open design) are set out with their concrete instances in https://github.com/cdeust/cortex-viz/blob/main/docs/ASSURANCE_CASE.md

The assurance case enumerates the common weakness classes for this kind of software (injection, path traversal, XSS, CSRF, DNS rebinding, permissive CORS, header injection, hardcoded credentials, supply-chain tampering), states the countermeasure for each, and marks the two that are not yet fully argued rather than claiming them: https://github.com/cdeust/cortex-viz/blob/main/docs/ASSURANCE_CASE.md

cortex-viz implements no cryptography. It stores no passwords, mints no keys, tokens, or nonces, and runs no cryptographic protocol: it is a local read-mostly visualization server bound to 127.0.0.1. Release signing is delegated entirely to Sigstore via GitHub's attest-build-provenance action, so no signing key is handled by this project's code.

cortex-viz implements no cryptography. It stores no passwords, mints no keys, tokens, or nonces, and runs no cryptographic protocol: it is a local read-mostly visualization server bound to 127.0.0.1. Release signing is delegated entirely to Sigstore via GitHub's attest-build-provenance action, so no signing key is handled by this project's code.

cortex-viz implements no cryptography. It stores no passwords, mints no keys, tokens, or nonces, and runs no cryptographic protocol: it is a local read-mostly visualization server bound to 127.0.0.1. Release signing is delegated entirely to Sigstore via GitHub's attest-build-provenance action, so no signing key is handled by this project's code.

cortex-viz implements no cryptography. It stores no passwords, mints no keys, tokens, or nonces, and runs no cryptographic protocol: it is a local read-mostly visualization server bound to 127.0.0.1. Release signing is delegated entirely to Sigstore via GitHub's attest-build-provenance action, so no signing key is handled by this project's code.

cortex-viz implements no cryptography. It stores no passwords, mints no keys, tokens, or nonces, and runs no cryptographic protocol: it is a local read-mostly visualization server bound to 127.0.0.1. Release signing is delegated entirely to Sigstore via GitHub's attest-build-provenance action, so no signing key is handled by this project's code.

cortex-viz implements no cryptography. It stores no passwords, mints no keys, tokens, or nonces, and runs no cryptographic protocol: it is a local read-mostly visualization server bound to 127.0.0.1. Release signing is delegated entirely to Sigstore via GitHub's attest-build-provenance action, so no signing key is handled by this project's code.

cortex-viz implements no cryptography. It stores no passwords, mints no keys, tokens, or nonces, and runs no cryptographic protocol: it is a local read-mostly visualization server bound to 127.0.0.1. Release signing is delegated entirely to Sigstore via GitHub's attest-build-provenance action, so no signing key is handled by this project's code.

cortex-viz implements no cryptography. It stores no passwords, mints no keys, tokens, or nonces, and runs no cryptographic protocol: it is a local read-mostly visualization server bound to 127.0.0.1. Release signing is delegated entirely to Sigstore via GitHub's attest-build-provenance action, so no signing key is handled by this project's code.

cortex-viz implements no cryptography. It stores no passwords, mints no keys, tokens, or nonces, and runs no cryptographic protocol: it is a local read-mostly visualization server bound to 127.0.0.1. Release signing is delegated entirely to Sigstore via GitHub's attest-build-provenance action, so no signing key is handled by this project's code.

Distribution channels use HTTPS exclusively. [osps_br_03_02]

No hash is fetched over HTTP and used. Release assets carry .sha256 companions served over HTTPS, and each artifact additionally carries a Sigstore build-provenance attestation verified with gh attestation verify <file> --repo cdeust/cortex-viz, which is a signature check rather than a bare hash comparison. https://github.com/cdeust/cortex-viz/blob/main/.github/workflows/release.yml

No known unpatched vulnerability of medium or higher severity in the software this project produces. The shipped artifact is the Python wheel (cortex_viz/ plus the static ui/ tree); package.json is private, is named cortex-viz-ui-tests, and declares NO runtime dependencies at all. The scoping matters and is stated rather than hidden: npm audit on 2026-07-28 reported 19 advisories (2 critical, 7 high) entirely within devDependencies of the vitest and Stryker test harness, none of which ships to any user. Remediation is tracked anyway, in https://github.com/cdeust/cortex-viz/issues/49

npm audit reports 0 vulnerabilities (2026-07-28) after upgrading the dev toolchain: @stryker-mutator/core and vitest-runner 8.7.1 to 9.6.1, vitest and @vitest/coverage-v8 2.1.8 to 4.1.10, jsdom 25 to 28, and an override pinning transitive qs to >=6.15.2 (GHSA-q8mj-m7cp-5q26). The full JS suite (175 tests) and the scoped Stryker mutation gate both pass on the upgraded toolchain with the same mutation score as before (99.15, same 3 documented survivors).

No credential is committed. DATABASE_URL is user-supplied configuration (plugin setting or environment variable), defaulting to a local, credential-free postgresql://127.0.0.1:5432/cortex; the project mints no secrets of its own. CodeQL runs continuously over both languages and OpenSSF Scorecard over the repository, and neither reports a leaked credential.

CodeQL with the security-and-quality suite, on BOTH languages, because cortex-viz is half browser-executed code: the standalone server is Python but the UI it serves is 98 JS files and about 26k lines that run in the user's browser. It runs on every push, every pull request, and a weekly cron, so a new query pack landing against unchanged code is still caught. https://github.com/cdeust/cortex-viz/blob/main/.github/workflows/codeql.yml. OpenSSF Scorecard additionally grades repository posture weekly: https://github.com/cdeust/cortex-viz/blob/main/.github/workflows/scorecard.yml

The security-and-quality suite includes CodeQL's security queries for both languages, which is how the current py/path-injection, js/remote-property-injection, and js/incomplete-html-attribute-sanitization alerts were surfaced at all.

Read against the criterion's wording, which is about vulnerabilities that have been CONFIRMED. CodeQL first ran on 2026-07-25 (issue #37) and reports 16 alerts at medium or higher: 10 py/path-injection and 2 js/remote-property-injection (high) and 4 js/incomplete-html-attribute-sanitization (medium). None has yet been confirmed exploitable, so none is unfixed-after-confirmation, and they are 3 days old rather than aged. What is known so far, stated plainly: a review of the static-serving sites shows the intended containment guard present (reject NUL, empty, .. and dot-prefixed components; resolve(); require containment in the base directory; require is_file()), and CodeQL does not model base in target.parents as a sanitizer, which makes those particular alerts candidate false positives. Candidate is not confirmed. Site-by-site triage, with a traversal regression test per site, is tracked in https://github.com/cdeust/cortex-viz/issues/46 and this answer flips to Unmet if that triage confirms one and it is not fixed promptly.

Every push, every pull request, and a weekly Monday cron, so inaction does not hide a new query pack. https://github.com/cdeust/cortex-viz/blob/main/.github/workflows/codeql.yml

No memory-unsafe language is used. The project is Python and browser JavaScript only; there is no C, C++, or unsafe Rust anywhere in the tree, and no compiled extension is authored by this project.

No dynamic code analysis is performed, so no vulnerability has been discovered by that means. This is the disposition the criterion's own details prescribe in that case.