SecureLayer

Continuously-deployed single website — there's only ever one live version, and visitors always see the current state. For anyone working with the source itself, the upgrade path is trivial and inherent: git pull && npm install, no breaking interface changes to manage since it's HEAD-only development with no distributed installs.

GitHub Issues is enabled and used as the project's issue tracker.

URL: https://github.com/SecureLayer/landing/issues

No vulnerabilities have been reported or resolved in the last 12 months so there's no reporter to credit.

URL: https://github.com/SecureLayer/tmp/security/advisories

https://github.com/SecureLayer/tmp/blob/main/SECURITY.md#coordinated-disclosure [osps_vm_01_01]

Adopted Prettier (+ prettier-plugin-astro) as the project's documented style guide
URL: https://github.com/SecureLayer/tmp/blob/main/.prettierrc.json

The Format check step in the CI workflow (npm run format:check) automatically enforces Prettier compliance on every push/PR.

URL: https://github.com/SecureLayer/tmp/blob/main/.github/workflows/ci.yml

No native binaries are compiled anywhere in this project — pure JS/TS/Astro static build, no C/C++/CC/CFLAGS involved.

This is a static site build (Astro → HTML/CSS/JS), not a compiled binary

Astro's build is a single unified pass over the whole source tree — no recursive per-subdirectory make-style builds, so the classic recursive-build cross-dependency problem this criterion targets doesn't arise.

The build is fully reproducible.

This project produces a website, not installable software — visitors browse it, they don't install/uninstall anything.

No installation system exists — same reasoning as installation_common, this is a website, not installable software.

The "Local development" section has everything :

• Runtime/SDK prerequisite
• Obtaining dependencies
• Build command
• Output location

Proof URL:
https://github.com/SecureLayer/tmp/blob/main/README.md#local-development [osps_do_07_01]

ci.yml uses only standard tooling for dependency ingestion:

• actions/setup-node with cache: 'npm'
• npm ci — npm's standard, official command specifically designed for CI/reproducible installs (installs exactly from package-lock.json, fails if it's out of sync)
• GitHub Actions themselves are resolved via GitHub's own standard uses: owner/repo@sha mechanism, not custom-fetched.

No hand-rolled install scripts, no curl-based vendoring, nothing ad-hoc anywhere in the pipeline.

Proof URL:
https://github.com/SecureLayer/tmp/blob/v2026.08.0/.github/workflows/ci.yml [osps_br_05_01]

Dependabot monitors the npm ecosystem weekly (.github/dependabot.yml) and GitHub's Dependabot security alerts flag known CVEs automatically.

URL: https://github.com/SecureLayer/tmp/blob/main/.github/dependabot.yml

https://github.com/SecureLayer/tmp/blob/main/package.json [osps_qa_02_01]

Dependencies are current (Astro 7, TypeScript 6), astro check under the strictest TS preset reports 0 errors/warnings (which would flag deprecated API usage via type definitions), and no legacy/deprecated browser APIs are used in the client-side scripts.

• scripts/check-links.mjs is on the repo, with /images/ + /docs/ exclusion
• ci.yml runs it as a real step on every push/PR.

it's a genuine behavioral test (verifies actual site links resolve, not just that code compiles), it runs automatically before any commit considered good on main.

Proof URL:
https://github.com/SecureLayer/tmp/blob/main/.github/workflows/ci.yml [osps_qa_06_01]

Broken internal links (public/images untracked) → guarded by check-links.mjs

• Contrast/accessibility bugs (the original legal-page fix and the 20+ new ones just found) → guarded by check-a11y.mjs, now the largest single bug category and fully covered
• Config/format drift (the wrangler.jsonc formatting failure) → guarded going forward by format:check in CI
• Type/config errors (the astro.config.mjs implicit-any bugs) → guarded by astro check under the strictest TS preset
• Lockfile drift → guarded by npm ci in CI, which fails hard on mismatch

No statement-coverage tool is currently wired into the project. The project itself is primarily declarative Astro markup with a comparatively small amount of imperative JS logic, so this is a real, acknowledged gap rather than an infeasible one.

CONTRIBUTING.md states it formally in writing as a PR merge requirement: "New functionality gets a test — if a PR adds major new functionality, add or extend an automated test covering it in scripts/ and wire it into npm test."

URL: https://github.com/SecureLayer/tmp/blob/main/CONTRIBUTING.md#requirements-for-acceptable-contributions

The test-policy line lives in CONTRIBUTING.md's "Requirements for acceptable contributions"

URL: https://github.com/SecureLayer/landing/blob/main/CONTRIBUTING.md#requirements-for-acceptable-contributions

URL: https://github.com/SecureLayer/landing/blob/main/tsconfig.json

• Minimal attack surface — static site, no server-side code, no database, no user auth/sessions
• Least privilege — every workflow scopes GITHUB_TOKEN permissions per-job (contents: read top-level, elevated only where actually needed)
• Defense in depth — hardened CSP (no unsafe-inline), harden-runner egress auditing on every CI job, every third-party Action pinned to a commit SHA (not a mutable tag)
• Fail-safe / economy of mechanism — deliberately minimal dependency surface (documented in README), zero secrets stored in any workflow (release signing uses keyless Sigstore/OIDC instead)
• Documented threat model — SECURITY_ASSESSMENT.md ranks real threats (account compromise, dependency supply-chain, malicious Action, third-party trust) and states mitigations per threat, not generically

URL: https://github.com/SecureLayer/tmp/blob/main/SECURITY_ASSESSMENT.md

no custom crypto is implemented in the project's own code (same as crypto_published), so there's no single hardcoded algorithm choice that could lock the project in.

No authentication credentials or private cryptographic keys are processed by the project's own code — no user auth, no stored passwords, no private keys (release signing is keyless/OIDC via Sigstore).

Plain http:// redirects (301) to https://, and HSTS is enforced (max-age=31536000; includeSubDomains) — confirmed live via curl. TLS 1.2+ only, no insecure protocol reachable by default.

TLS 1.2 confirmed live via a real handshake (curl --tls-max 1.2), negotiated ECDHE-ECDSA-CHACHA20-POLY1305 — a modern, secure cipher suite, not just the bare minimum.

No code anywhere disables TLS certificate verification. All subresources (Google Fonts, dock icon links, badges) load over HTTPS in the browser, which verifies certificates by default; nothing in this project's own code overrides that.

The site sets zero cookies and sends no private-information headers. Nothing that would need to be gated behind certificate verification even applies here. And per the earlier answer, cert verification is never disabled regardless.

Release with signed assets: https://github.com/SecureLayer/tmp/releases/tag/v2026.08.0
Attestation record: https://github.com/SecureLayer/tmp/attestations [osps_br_06_01]

No form submissions, no API endpoints, no user-uploaded data — this is a static informational site with no server-side code that accepts external input at all.

Real, verified hardening headers live: default-src 'none' deny-by-default CSP (only 'self' plus a short explicit allowlist), X-Content-Type-Options: nosniff, X-Frame-Options: DENY + frame-ancestors 'none', HSTS with includeSubDomains, Referrer-Policy: no-referrer. Plus TypeScript's strictest preset at the build level and CI's astro check/CodeQL/format gates catching defects before they ship — several layers so a single defect is less likely to become exploitable.

https://github.com/SecureLayer/tmp/blob/main/SECURITY_ASSESSMENT.md [osps_sa_03_01]

No custom queries: override in codeql.yml, so it runs CodeQL's default query suite for javascript-typescript, which includes CWE-mapped security queries (XSS, injection, prototype pollution, insecure randomness, etc.) .

URL: https://github.com/SecureLayer/landing/blob/main/.github/workflows/codeql.yml

No memory-unsafe language is used anywhere in this project — it's entirely Astro/TypeScript/JavaScript (JS/TS are memory-managed).