review-bot-automator

The project maintains supported versions documented in SECURITY.md (v2.x supported, pre-release versions not supported with upgrade path documented). CHANGELOG.md documents all changes and migration steps for breaking
changes. Semantic versioning is followed.
URL: https://github.com/VirtualAgentics/review-bot-automator/blob/main/SECURITY.md#supported-versions

GitHub Issues tracker with labels (bug, enhancement, etc.)

No security vulnerabilities have been reported or resolved in the last 12 months. SECURITY.md section "Acknowledgments" states researchers will be credited unless they prefer anonymity.
URL: https://github.com/VirtualAgentics/review-bot-automator/blob/main/SECURITY.md#acknowledgments

SECURITY.md documents the complete vulnerability response process including: private disclosure via GitHub Security tab, response timelines (72 hours for critical, 7 days for high severity), investigation steps, fix
development, and coordinated disclosure policy.
URL: https://github.com/VirtualAgentics/review-bot-automator/blob/main/SECURITY.md#what-to-expect

CONTRIBUTING.md identifies PEP 8 as the coding style guide for Python. The project explicitly states "This project follows PEP 8 style guidelines" and references the official PEP 8 URL.
URL: https://github.com/VirtualAgentics/review-bot-automator/blob/main/CONTRIBUTING.md#python-code-style

Coding standards are automatically enforced via Black (formatting), Ruff (linting with PEP 8 rules), and MyPy (type checking). Pre-commit hooks and CI pipeline enforce these on every commit and PR. Configuration in
pyproject.toml and .pre-commit-config.yaml.
URL: https://github.com/VirtualAgentics/review-bot-automator/blob/main/CONTRIBUTING.md#python-code-style

This is a pure Python project that does not generate native binaries. No C/C++ compilation occurs. Package is built using Python build tools (setuptools/wheel) which don't use CC/CFLAGS/LDFLAGS.

Pure Python project with no native binary compilation. Python debugging is handled through standard Python mechanisms (pdb, tracebacks) which don't require debug symbols in the traditional sense.

Python project uses pyproject.toml for build configuration, not make-based recursive builds. Python's build system handles dependencies correctly through pip/setuptools without subdirectory recursion issues.

Python source distribution and wheels are used directly without compilation. The project uses hash-pinned dependencies in requirements.txt files generated via pip-compile --generate-hashes for reproducible dependency resolution.

Package is installable via pip (pip install review-bot-automator) from PyPI. Can be uninstalled via pip uninstall. Supports virtual environments and standard Python packaging conventions.
URL: https://github.com/VirtualAgentics/review-bot-automator/blob/main/README.md#-quick-start

Python pip-based installation does not use DESTDIR. Python packages install to site-packages via pip which handles installation locations through standard pip mechanisms (--prefix, --user, virtual environments).

CONTRIBUTING.md documents quick development setup: clone repo, run ./setup-dev.sh which creates virtual environment and installs all dependencies including test environment. Alternative manual setup also documented.
URL: https://github.com/VirtualAgentics/review-bot-automator/blob/main/CONTRIBUTING.md#quick-setup-recommended

Dependencies listed in pyproject.toml (runtime) and requirements-dev.txt (development) in computer-processable format. Uses pip-compile to generate pinned requirements with hashes.
URL: https://github.com/VirtualAgentics/review-bot-automator/blob/main/pyproject.toml

Dependencies monitored via: pip-audit (vulnerability scanning in CI), Trivy (SBOM and CVE scanning), Renovate (automated updates), and OpenSSF Scorecard (dependency hygiene). Security workflow runs on every PR.
URL: https://github.com/VirtualAgentics/review-bot-automator/blob/main/.github/workflows/security.yml

All dependencies are standard PyPI packages managed through pip. No vendored/forked copies. Renovate automatically creates PRs for dependency updates. Hash-pinned requirements enable reproducible updates.
URL: https://github.com/VirtualAgentics/review-bot-automator/blob/main/CONTRIBUTING.md#dependency-management-and-security

Project uses modern Python 3.12+ features and current library versions. Ruff linter flags deprecated APIs. Renovate keeps dependencies current. No use of deprecated Python standard library functions.

GitHub Actions CI workflow runs full test suite on every push and PR to main branch. Test results reported in workflow summary. Coverage reports generated and published to Codecov.
URL: https://github.com/VirtualAgentics/review-bot-automator/blob/main/.github/workflows/ci.yml

CONTRIBUTING.md states "Bug fixes require regression tests to prevent recurrence" as formal policy. PRs without adequate test coverage are not merged. Test suite includes regression tests for previously fixed bugs.
URL: https://github.com/VirtualAgentics/review-bot-automator/blob/main/CONTRIBUTING.md#testing-policy-mandatory

Project enforces 80% minimum statement coverage in CI. Current coverage is 89%+ per Codecov. Coverage measured using pytest-cov (Python FLOSS tool). Pre-push hooks and CI fail if coverage drops below 80%.
URL: https://codecov.io/gh/VirtualAgentics/review-bot-automator

CONTRIBUTING.md contains formal written policy: "All new functionality MUST include tests. This is a formal project policy: New features require corresponding unit tests, Bug fixes require regression tests, PRs without
adequate test coverage will not be merged."
URL: https://github.com/VirtualAgentics/review-bot-automator/blob/main/CONTRIBUTING.md#testing-policy-mandatory

CONTRIBUTING.md section "Testing" documents the test policy with specific requirements: unit tests, integration tests, property-based fuzzing, >80% coverage, pytest fixtures, and subtests usage. Additional guidance in docs/testing/TESTING.md
and docs/testing/SUBTESTS_GUIDE.md.

MyPy runs with --strict flag (maximum strictness). Ruff is configured with comprehensive rules in pyproject.toml. Black enforces consistent formatting with 100-char line length. Bandit scans for security issues. All tools run on both src/ and tests/ directories.

Project implements secure design principles documented in docs/security/assurance-case.md: fail-safe defaults (dry-run by default), complete mediation (all paths validated), least privilege (workspace containment), defense
in depth (5 security layers). OWASP Top 10 and CWE Top 25 countermeasures implemented.
URL: https://github.com/VirtualAgentics/review-bot-automator/blob/main/docs/security/assurance-case.md

No cryptographic algorithms with known weaknesses. SHA-256 is used exclusively for hashing (SHA-1 never used). No SSH connections made by the application. HTTPS uses TLS 1.2+ via standard Python libraries. No CBC mode or other weak modes are configured by the application.

Project does not implement custom cryptography. Uses standard libraries (hashlib for SHA-256 cache keys, HTTPS for transport). Cryptographic algorithm selection delegated to Python standard library and TLS.

Credentials (GitHub tokens, API keys) stored in environment variables, not code. Configuration separate from code. Users can update credentials without code changes. SecretScanner prevents accidental credential commits.
URL: https://github.com/VirtualAgentics/review-bot-automator/blob/main/SECURITY.md#security-best-practices

All network communications use HTTPS (TLS). GitHub API client enforces certificate verification. No insecure protocols (HTTP, FTP, telnet) are used or supported.
URL: https://github.com/VirtualAgentics/review-bot-automator/blob/main/docs/security/threat-model.md

Uses Python requests library which defaults to TLS 1.2+. Python 3.12 enforces minimum TLS 1.2. No explicit TLS version downgrades in code.

Certificate verification enabled by default for all HTTPS connections. Python requests library verifies certificates. InputValidator.validate_github_url() includes certificate validation.
URL: https://github.com/VirtualAgentics/review-bot-automator/blob/main/docs/security/threat-model.md

Certificate verification occurs before any HTTP request (including headers with tokens). Python requests library performs TLS handshake and certificate verification before sending any HTTP headers.

Releases use SLSA Level 3 provenance via SLSA GitHub Generator. Each release includes .intoto.jsonl provenance file for cryptographic verification. Users can verify using slsa-verifier tool. Process documented in
SECURITY.md.
URL: https://github.com/VirtualAgentics/review-bot-automator/blob/main/SECURITY.md#release-signing-slsa-provenance

Version tags are cryptographically signed via SLSA provenance attestations (not GPG). SLSA Level 3 provenance proves artifacts were built from claimed source. Verification instructions in SECURITY.md.
URL: https://github.com/VirtualAgentics/review-bot-automator/blob/main/SECURITY.md#release-signing-slsa-provenance

InputValidator class validates all external inputs using allowlists: file paths checked for traversal and normalized, URLs validated against GitHub API patterns, content validated against expected structures
(JSON/YAML/TOML), tokens validated for format. Invalid inputs rejected.
URL: https://github.com/VirtualAgentics/review-bot-automator/blob/main/src/review_bot_automator/security/input_validator.py

Multiple hardening mechanisms: safe parsers prevent code injection (yaml.safe_load), atomic file operations prevent TOCTOU, workspace containment prevents path traversal, secret scanning prevents credential leakage, CSP-like
input validation. Security controls documented in assurance case.
URL: https://github.com/VirtualAgentics/review-bot-automator/blob/main/docs/security/assurance-case.md

Comprehensive assurance case in docs/security/assurance-case.md includes: threat model description, trust boundaries diagram, secure design principles mapping (Saltzer & Schroeder), OWASP Top 10 countermeasures table, CWE
Top 25 countermeasures table, implementation evidence with code references.
URL: https://github.com/VirtualAgentics/review-bot-automator/blob/main/docs/security/assurance-case.md

Multiple tools specifically designed for vulnerability detection: (1) Bandit - detects Python security issues (CWE patterns, injection, etc.); (2) CodeQL - semantic analysis for security vulnerabilities with Python-specific queries; (3) Ruff S rules - Bandit-equivalent security rules integrated into Ruff (see pyproject.toml line 124: "S"). These tools detect OWASP Top 10 and CWE/SANS Top 25 vulnerabilities including injection, path traversal, and insecure deserialization.

ClusterFuzzLite runs with memory safety sanitizers for the Python C extensions and underlying libraries: (1) Address Sanitizer (ASan) - detects buffer overflows, use-after-free; (2) Undefined Behavior Sanitizer (UBSan) - detects undefined
behavior. Configuration in .github/workflows/clusterfuzzlite.yml lines 57, 67: sanitizer: [address, undefined]. Fuzzing targets test security-critical components (InputValidator, SecretScanner, file handlers).