codeiq

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

Squash-merge from PR branches into main is the only path; every interim change is reviewable as a PR commit on the feature branch before squash. Branch protection on main rejects unsigned commits and unreviewed merges.

Repository on GitHub, which uses git. git is distributed.

Maven coordinates io.github.randomcodespace.iq:code-iq with semver version strings (v0.0.1-beta.0 … v0.0.1-beta.46, v0.1.0). Each release is an immutable Maven Central artifact + an immutable GPG-signed git tag (vX.Y.Z) cut by .github/workflows/release-java.yml.

Versioning follows Semantic Versioning 2.0.0: pre-1.0 line is 0.X.Y (currently 0.1.x); hot-fix path documented as X.Y.Z+1 in shared/runbooks/release.md §5; pre-releases tagged v0.0.1-beta.N. Maven Central + git tags are the immutable record.

Every release is a GPG-signed annotated git tag pushed to https://github.com/RandomCodeSpace/codeiq (e.g. v0.1.0, v0.0.1-beta.46). The release-java.yml workflow creates and pushes the tag pointing at the deployed release commit.

Per SECURITY.md, security fixes are surfaced via GHSA advisories on the repo Security tab and credited in the corresponding GitHub Release notes; a hot-fix patch path is codified in shared/runbooks/release.md §5.

Non-trivial SECURITY[.md] file found file in repository: https://github.com/RandomCodeSpace/codeiq/blob/main/SECURITY.md. [osps_do_02_01]

GitHub Issues at https://github.com/RandomCodeSpace/codeiq/issues — public, addressable per ticket, supports labels, milestones, and cross-references with PRs.

SECURITY.md commits the maintainer to acknowledge reports within 72 hours and triage within 7 days with a CVSS rating. Public issue threads are responded to in days; Paperclip-tracked work feeds back to GitHub via PRs.

Maintainer triages enhancement requests on GitHub Issues, with public PRs cross-linking to the originating issue (e.g. recent merges PR #91 / PR #92 / PR #95). Internal coordination tracked in Paperclip; outward-facing decisions surface as PR descriptions and release notes.

GitHub private vulnerability reporting is enabled (https://github.com/RandomCodeSpace/codeiq/security/advisories/new); a private email channel (ak.nitrr13@gmail.com, subject prefix [codeiq security]) is offered as a fallback in SECURITY.md.

SECURITY.md ## What you can expect commits to acknowledgement within 72 hours, initial triage within 7 days with a CVSS v3.1 severity rating, and coordinated disclosure with the reporter (default 90 days, sooner for low-impact / already-public issues).

Non-trivial build file in repository: https://github.com/RandomCodeSpace/codeiq/blob/main/pom.xml.

Non-trivial build file in repository: https://github.com/RandomCodeSpace/codeiq/blob/main/pom.xml.

Build chain is end-to-end FLOSS: OpenJDK 25 (GPL-2.0-with-classpath-exception) + Apache Maven 3.9+ (Apache-2.0) + Maven Wrapper. Runs on any Linux/macOS/Windows host without proprietary tooling. CI pinned to free GitHub-hosted runners.

Project ships with ~3219 JUnit/Spring tests in src/test/java covering analyzer, detectors (positive/negative/determinism per detector), graph store, query/topology services, MCP tools, REST controllers, and end-to-end pipelines (E2EQualityTest). Run with mvn test or mvn verify.

Single command — mvn test (or mvn verify for the full quality gate). Documented in README Quick Start and shared/runbooks/first-time-setup.md; identical command runs locally and in .github/workflows/ci-java.yml.

JaCoCo line-coverage rule in pom.xml enforces project-wide ≥ 85% line coverage (post-exclusions). ~3219 tests cover analyzer, every detector (with positive/negative/determinism cases), graph store, query/topology services, MCP tools, REST controllers, and full-pipeline E2EQualityTest.

.github/workflows/ci-java.yml runs mvn -B -ntp clean verify on every push and pull request to main; mean-time-to-merge for incoming PRs is single-digit hours. Engineering-standards §1 lists CI checks as merge gates.

shared/runbooks/test-strategy.md and shared/runbooks/engineering-standards.md §4 codify the policy: every detector requires positive, negative, and determinism tests; new logic requires accompanying tests; flakes must be fixed/quarantined/deleted in the same PR; JaCoCo line coverage gate ≥ 85% is enforced in pom.xml.

Engineering-standards §3–4 plus CLAUDE.md (Adding a New Detector) require accompanying tests for every new detector or feature; reviewers block PRs that change behaviour without test deltas. JaCoCo ≥ 85% coverage gate (pom.xml) blocks merge if regressed.

shared/runbooks/test-strategy.md + shared/runbooks/engineering-standards.md §4 explicitly require accompanying tests for new logic; CLAUDE.md (Adding a New Detector) lists per-detector test requirements (positive, negative, determinism). Reviewers block PRs that ship behaviour without test deltas.

SpotBugs static-analysis pass via mvn spotbugs:check is bound to verify and gates merge — zero High/Critical findings tolerated; spotbugs-exclude.xml entries require per-entry justification (engineering-standards §1).

Per engineering-standards §1, SpotBugs High/Critical findings block merge; existing exclusions are listed in spotbugs-exclude.xml with rationale. Compiler warnings surface during mvn -B verify; engineering-standards §2 requires exception hygiene (no swallowed warnings).

SpotBugs runs in strict mode (mvn spotbugs:check, zero High/Critical findings, bound to the verify phase). Semgrep runs at ERROR threshold. JaCoCo coverage gate is also strict. Engineering-standards §1 lists each as a merge gate.

shared/runbooks/engineering-standards.md §5 (Security) codifies least-privilege, parameterised queries, AEAD ciphers (TLS 1.2+), no MD5/SHA-1 for integrity, and no secrets in code/logs. SECURITY.md scopes the threat model (path traversal, deserialisation, SSRF, etc.) for the serve subcommand.

Engineering-standards §5 + CLAUDE.md Critical Rules call out OWASP-relevant classes (path traversal, injection, secret handling). Semgrep p/owasp-top-ten + p/security-audit + p/java rulesets run on every push via .github/workflows/security.yml.

Cryptographic primitives used by codeiq are JDK 25 standards: SHA-256 via java.security.MessageDigest in cache/FileHasher.java (publicly published, NIST FIPS 180-4) and TLS via the JDK's javax.net.ssl stack when serving over HTTPS. No proprietary crypto.

codeiq calls SHA-256 only via the JDK's java.security.MessageDigest API (cache/FileHasher.java) and consumes JDK TLS via javax.net.ssl. No reimplementation of cryptographic primitives.

All crypto primitives ship with the OpenJDK 25 runtime (GPL-2.0-with-classpath-exception, FLOSS). codeiq adds no proprietary crypto provider.

FileHasher uses SHA-256 (256-bit digest, NIST-approved). When TLS is active, the JDK 25 default cipher suite negotiates AES-128/256-GCM with ≥ 2048-bit RSA / ≥ 256-bit EC key exchange — all above the 112-bit symmetric / 2048-bit asymmetric NIST floor.

Hash function is SHA-256 only (cache/FileHasher.java) — no MD5, no SHA-1 for integrity. TLS settings inherit JDK 25 defaults, which disable SSLv3, TLS 1.0, TLS 1.1, RC4, and 3DES. Engineering-standards §5 hard-bans MD5/SHA-1 for integrity.

Engineering-standards §5 hard-bans MD5/SHA-1 for integrity, ECB mode, hardcoded IVs/keys, and TLS < 1.2. FileHasher exclusively uses SHA-256. JDK 25 default TLS configuration disables RC4/3DES/SSLv3/TLS 1.0/1.1.

codeiq does not operate a public network service. The bundled serve subcommand binds to localhost for developer use; production-grade TLS termination (with PFS cipher suites) is the operator's responsibility per SECURITY.md (Out of scope: public-internet attack surface).

codeiq is a developer-side static-analysis tool. The product does not authenticate users, store passwords, or operate as a multi-tenant service — there is no password store. SECURITY.md scope makes the threat model explicit.

Where security-relevant randomness is needed (e.g., UUID generation), codeiq relies on the JDK 25 java.security.SecureRandom / java.util.UUID#randomUUID() (which delegates to SecureRandom). No use of java.util.Random for security purposes.

Distribution channels use HTTPS exclusively. [osps_br_03_02]

.github/workflows/release-java.yml signs the release commit with GPG, deploys signed Maven artifacts to Sonatype Central, then creates and pushes a GPG-signed annotated tag pointing at that commit. Every commit on main is ssh-signed and branch protection rejects unsigned commits (engineering-standards §1).

Engineering-standards §1 + §5 plus SECURITY.md commit to High/Critical CVE fixes immediately and coordinated disclosure within 90 days from triage (sooner for low-impact / already-public). The OSS-CLI stack in .github/workflows/security.yml (OSV-Scanner + Trivy + Semgrep + Gitleaks) blocks merge on High/Critical findings — driving fixes inside 60 days.

OSS-CLI stack in .github/workflows/security.yml — OSV-Scanner (npm lockfile via OSV.dev = GHSA + ecosystem feeds), Trivy (filesystem + Maven + container scan, severity: HIGH,CRITICAL, exit-code: 1), Semgrep (security-audit + owasp-top-ten + java) — all block merge on High/Critical findings. Engineering-standards §1 makes the gate non-negotiable.

Gitleaks runs against the full git history on every push + PR (.github/workflows/security.yml — gitleaks detect --source . --redact --no-banner --exit-code 1); zero findings is a merge gate. GitHub repo-level secret scanning + push protection are also enabled.

Two SAST passes gate every merge: (1) SpotBugs Java bytecode analysis (mvn spotbugs:check bound to verify) — zero High/Critical findings tolerated; (2) Semgrep with p/security-audit + p/owasp-top-ten + p/java rulesets in .github/workflows/security.yml — zero ERROR-level findings tolerated. SARIF from GitHub repo-level CodeQL default setup (java-kotlin + javascript-typescript + actions) is published to the Security tab.

Semgrep rulesets p/owasp-top-ten + p/security-audit + p/java cover the OWASP Top 10 and common Java attack patterns; SpotBugs's FindSecBugs-style checks cover Java bytecode patterns. Both run in .github/workflows/security.yml on every push + PR + weekly schedule.

Engineering-standards §1 makes SpotBugs and Semgrep findings hard merge gates — High/Critical SpotBugs and ERROR-level Semgrep both block PRs. Outstanding findings are fixed before merge or, in rare cases, suppressed in spotbugs-exclude.xml with per-entry justification reviewed by TechLead.

.github/workflows/security.yml triggers on push to main, pull_request, and a weekly cron — Semgrep + OSV-Scanner + Trivy + Gitleaks + jscpd run on each. Scorecard runs weekly (Mondays 06:00 UTC) per .github/workflows/scorecard.yml.

codeiq is written in Java 25 — a memory-safe, garbage-collected language with no manual pointer arithmetic. The criterion (memory-safety dynamic analysis) does not apply to this language.

Trivy filesystem + container scan (severity: HIGH,CRITICAL, exit-code: 1) in .github/workflows/security.yml gates every PR — High/Critical findings block merge. Any future High/Critical dynamic-analysis finding is treated under the engineering-standards §5 / SECURITY.md remediation policy (fix immediately, disclose within 90 days).