flask-todolist

An explicit N-1 upgrade contract (ADR 0048): every push proves the previous release's code still serves on HEAD's schema, and migrations follow expand-contract so rolling upgrades never kill the older version. Users upgrade by moving to the latest release.

GitHub Issues is the tracker: https://github.com/sayam/flask-todolist/issues

No externally reported vulnerabilities have been resolved yet. The policy already commits to credit: SECURITY.md states reporters will be credited in the advisory unless they request anonymity. https://github.com/sayam/flask-todolist/blob/main/SECURITY.md

Documented with deadlines and enforced by a test-read cadence: acknowledgment within 7 days, initial assessment within 14, fixes within severity windows (critical 7 / high 30 / medium 90 days). https://github.com/sayam/flask-todolist/blob/main/SECURITY.md

https://github.com/sayam/flask-todolist/blob/main/docs/STANDARDS.md (tooling and standards decisions) plus CONTRIBUTING.md's enforced rules.

Enforced by CI on every push: ruff with every rule enabled (exceptions justified one by one), ruff format, mypy strict, xenon complexity ceiling, interrogate docstring floor — all thresholds ratchet in one direction only.

Python is interpreted; there is no compiled build step and no build-flag variables to honor.

No compiled build; nothing strips debug information.

No build system; not applicable.

The artifacts the project produces are repeatable: dependencies are fully hash-locked (Pipfile.lock, hash-pinned CI tool lockfiles, digest-pinned base image), the container image builds from those locks, and release SBOMs are regenerated deterministically in CI from the tag's own code (ADR 0058).

Standard ecosystem installs: pipenv for local (README quick start), or docker compose for the full stack — both documented, plus flask CLI commands for setup.

Installation uses the ecosystems' own conventions (pip/pipenv virtualenvs, Docker images and volumes); there is no custom installer that could deviate from them.

A contributor is running in five commands (README "Try it"); CONTRIBUTING's setup section adds the pre-commit hook install. First-time clone to running dev server takes minutes.

Dependencies are listed in the Pipfile (per-plugin categories, ADR 0025) and shipped as per-category SBOMs with every release; the supply-chain axis document indexes the 18 gates guarding them. https://github.com/sayam/flask-todolist/blob/main/docs/SUPPLY-CHAIN.md

Dependabot (security + version updates for everything pinned) plus pip-audit/npm-audit gates on every push across all layers — core, deploy, plugins, CI tools, and the image's OS layer — with two-way exception lists that go red when an accepted advisory disappears.

All components are standard packages installed from lockfiles; nothing is vendored or forked, so everything is updateable in place.

Current stable APIs throughout: Python 3.13, SQLAlchemy 2.0 typed style, Flask current — deprecation warnings surface through the strict lint/type gates.

Every push runs the suite against real MySQL 8 and MariaDB 11, brings up the full compose stack (nginx, TLS, two replicas) and walks real journeys through it, logs in through a real OIDC provider and a real LDAP directory, and DAST-scans the running stack authenticated.

Every bug fix lands with a test proven to catch it (the mutation rule: break the code, watch the test go red, restore). The changelog's fix entries each cite their regression tests.

Statement coverage is gated at 97% (branch coverage enabled) and ratchets upward only; diff coverage on changed lines is gated at 100%.

CONTRIBUTING rule 1: every new test must be proven to catch a real break before it counts as done; rule 8: every test file must be registered to exactly one gate in gates.yaml or CI fails.

The policy is documented in CONTRIBUTING ("The rules that will surprise you") and enforced mechanically by the gates registry test.

Maximally strict: ruff with all rules on, mypy strict, xenon complexity max B, interrogate docstring floor — warnings are errors in CI and thresholds only tighten.

Secure-design principles are implemented and tested: least privilege (non-root read-only container, numeric UID, scoped tokens), complete mediation (authorization in the service layer, ownership 404s per ADR 0004), fail-safe defaults (config errors refuse to start), separation of machine and human credential paths, and defense in depth documented in the ASVS worksheet.

No broken crypto in defaults. The single documented exception is HMAC-SHA1 inside TOTP as RFC 6238 requires (acceptable for HMAC per NIST), recorded openly in docs/ASVS.md V11.4.1.

Algorithms are replaceable: encrypted secrets carry a versioned format (enc:v1:, ADR 0046) so a future algorithm rotates row-by-row; password hashes use werkzeug's self-describing format, upgradable on verify.

Credentials live outside the code and rotate independently: SECRET_KEY and DATA_ENCRYPTION_KEY come from a declared secrets source (env/file/vault, ADR 0030), are deliberately separate keys, and rotation behavior is documented in docs/OPERATIONS.md.

TLS is first-class: the shipped stack terminates TLS at the proxy with HTTPS_ENABLED wiring HSTS/secure cookies, and CI proves the TLS stack end to end on every push.

A dedicated gate (tls-modern-protocols-only) proves on every push that the served stack accepts only modern TLS protocol versions, with forward secrecy proven by its sibling gate.

All outbound TLS clients (OIDC, Vault, LDAP plugins) use their libraries' default certificate verification; verification is never disabled anywhere in the codebase.

Certificate verification happens before any private data is sent: the OIDC/Vault/LDAP clients verify certificates as part of connection establishment (library defaults, never disabled) before tokens or credentials travel.

All release artifacts (per-category SBOMs) are generated inside CI, signed keyless via sigstore/cosign, and carry SLSA provenance via GitHub artifact attestations. Verification commands are documented in SECURITY.md: https://github.com/sayam/flask-todolist/blob/main/SECURITY.md (see also ADR 0058)

Inputs are validated with an allowlist posture: API schemas reject unknown fields and parameters (marshmallow RAISE), the service layer re-validates domain rules, external ids pass through a bounds-checked lookup, and the API is fuzzed against its own OpenAPI contract on every push.

Hardening mechanisms throughout: strict CSP with no inline script/handlers (test-enforced), full security-header suite via Talisman, read-only non-root container, session hardening (fixation reset, credential-bound cookies), and hadolint/trivy gates on the image itself.

The assurance case is the ASVS worksheet chain: security requirements assessed item-by-item (253/253) with machine-verified evidence, cross-walked to the enforcing gates in docs/GATES-ASVS.md, with the architecture description covering trust boundaries. https://github.com/sayam/flask-todolist/blob/main/docs/ASVS.md

Two engines look specifically for common vulnerabilities on every push: CodeQL with the security-extended suite and semgrep with the flask+python rulesets — with a gate proving the scan actually covered every file it claims to.

The project is written in Python, a memory-safe language; no memory-unsafe code is included.