discovery-media-player

Only the latest release is supported and SECURITY.md's support table says so plainly; the upgrade path is documented (npm update, and docs/MIGRATIONS.md for a database already in service — every schema migration is replayable and tested against yesterday's install). https://github.com/Juli1artha/discovery-media-player/blob/main/SECURITY.md

GitHub issue tracker, three structured forms, blank issues disabled. https://github.com/Juli1artha/discovery-media-player/issues

No vulnerability report has been resolved in the last 12 months, so there is nobody to credit yet. SECURITY.md commits to crediting reporters in the changelog unless they request anonymity. https://github.com/Juli1artha/discovery-media-player/blob/main/SECURITY.md

Documented in SECURITY.md: acknowledgement within 72 hours, assessment within 7 days, coordinated disclosure, and two private reporting channels (GitHub private vulnerability reporting, plus a direct address). https://github.com/Juli1artha/discovery-media-player/blob/main/SECURITY.md

The style guide is identified and tooled: the ESLint + typescript-eslint configuration is committed in the repository, and the conventions are written in CONTRIBUTING.md and AGENTS.md. https://github.com/Juli1artha/discovery-media-player/blob/main/eslint.config.mjs

Enforced mechanically and blocking in CI: eslint --max-warnings 0 over bin, context, server, src, build, tools and charge — a single warning stops the build. https://github.com/Juli1artha/discovery-media-player/blob/main/.github/workflows/ci.yml

No native binaries are generated: pure JavaScript/TypeScript, no compiler or linker environment variables to honor.

Nothing is stripped: the package ships readable JavaScript, and the committed generated bundles carry a header naming the sources they come from.

One root-level build invocation (esbuild + tsc) regenerates everything; there are no recursive sub-directory builds. https://github.com/Juli1artha/discovery-media-player/blob/main/build/bundle.mjs

Repeatability is verified rather than declared: the release pipeline's "attester" job rebuilds the tarball from source and refuses to attach anything to the release if its sha512 differs from what the npm registry serves — re-proven at every release. https://github.com/Juli1artha/discovery-media-player/blob/main/docs/VERIFYING-RELEASES.md

npm install / npm uninstall, or the container image — the platform's standard mechanisms, shown in the README. https://github.com/Juli1artha/discovery-media-player/blob/main/README.md

Install locations follow npm and Docker conventions (documented volumes), and an instance is described entirely by environment variables — all of them listed, with a CI guard keeping the list complete. https://github.com/Juli1artha/discovery-media-player/blob/main/docs/CONFIGURATION.md

npm install && npm test: offline, in seconds, no database and no browser required — stated in CONTRIBUTING.md's "Getting set up". https://github.com/Juli1artha/discovery-media-player/blob/main/CONTRIBUTING.md

Machine-processable in three forms: package.json, package-lock.json (the full graph with integrity hashes), and a CycloneDX SBOM attached to every GitHub release. https://github.com/Juli1artha/discovery-media-player/blob/main/package.json

Dependabot (npm, GitHub Actions, Docker base images) plus npm audit blocking in CI, at thresholds documented in docs/DEPENDENCIES.md: production dependencies tolerate no known vulnerability of any severity. https://github.com/Juli1artha/discovery-media-player/blob/main/docs/DEPENDENCIES.md

Every reused component comes from npm and updates through npm; no third-party code is copied into the tree. https://github.com/Juli1artha/discovery-media-player/blob/main/docs/DEPENDENCIES.md

Node >= 22, strict TypeScript, current ESLint; no deprecated APIs in use, and the zero-warning lint would refuse one. https://github.com/Juli1artha/discovery-media-player/blob/main/package.json

The full suite (166 files, ~1,800 tests) runs on every push and every pull request, on Node 22 and 24, with pass/fail reported per run — plus browser, real-database and load benches on the same trigger. https://github.com/Juli1artha/discovery-media-player/blob/main/.github/workflows/ci.yml

The repository's standing rule does better than the 50% bar: every bug fix ships with the test that fails without it (the test's comment names what broke and when), and the CHANGELOG links finding, fix and test version by version. https://github.com/Juli1artha/discovery-media-player/blob/main/CONTRIBUTING.md

Statement coverage is 83% and is printed by CI on every run of main, with an 80% floor that fails the build below it (job "check (22)", step "Statement coverage is public evidence"). Example log: https://github.com/Juli1artha/discovery-media-player/actions/runs/32822195887/job/97722496886 (Statements: 83.09%). Workflow: https://github.com/Juli1artha/discovery-media-player/blob/main/.github/workflows/ci.yml

Formal written policy: "a behaviour worth keeping is worth a test that fails without it" — with the requirement that the test's name says what it protects. https://github.com/Juli1artha/discovery-media-player/blob/main/CONTRIBUTING.md

The policy lives inside the contribution instructions themselves — the exact place this criterion requires. https://github.com/Juli1artha/discovery-media-player/blob/main/CONTRIBUTING.md

Maximally strict: tsc strict mode plus noUnusedLocals, noUnusedParameters and noFallthroughCasesInSwitch; ESLint at --max-warnings 0. Zero warnings tolerated, blocking in CI. https://github.com/Juli1artha/discovery-media-player/blob/main/tsconfig.json

Secure design principles are implemented and named in the threat model: the core fails closed, least privilege down to individual CI jobs (each release job holds disjoint permissions), explicit refusals, nonce-based CSP — each measure tied to the threat it counters. https://github.com/Juli1artha/discovery-media-player/blob/main/docs/THREAT-MODEL.md

SHA-256 and HMAC-SHA256 only; no MD5, no SHA-1, no CBC anywhere in the tree, and secret comparisons use timingSafeEqual. https://github.com/Juli1artha/discovery-media-player/blob/main/docs/SECURITY-PRACTICES.md

The primitives are the platform's (node:crypto / WebCrypto) rather than a configurable set. Switching algorithms would be a release, not a data migration: the player stores no long-term cryptographic artifacts that an algorithm could hold captive, so agility-by-release is deliberate. https://github.com/Juli1artha/discovery-media-player/blob/main/docs/SECURITY-PRACTICES.md

Credentials live exclusively outside the code, as environment variables: .env.example lists them all with empty values, a CI guard refuses any plaintext credential entering the tree, and replacing a credential requires no recompilation. https://github.com/Juli1artha/discovery-media-player/blob/main/docs/SECURITY-PRACTICES.md

All outbound communications are HTTPS, and anything else is refused: the SSRF allow-list accepts only https URLs, PLAYER_HOST_FETCH_BASE requires https (the shared secret would otherwise travel in clear), and redirects to other schemes are rejected. https://github.com/Juli1artha/discovery-media-player/blob/main/context/storage.js

TLS is Node's own (engines: node >= 22): TLS 1.2 minimum by default, and no repository setting lowers it — a public code search for rejectUnauthorized or custom TLS options returns zero results. https://github.com/Juli1artha/discovery-media-player/blob/main/package.json

Node's default certificate verification, never disabled — and the proof is checkable by anyone: a GitHub code search for rejectUnauthorized or NODE_TLS_REJECT_UNAUTHORIZED over this repository returns zero results. https://github.com/search?q=repo%3AJuli1artha%2Fdiscovery-media-player+rejectUnauthorized+OR+NODE_TLS_REJECT_UNAUTHORIZED&type=code

Nothing private is sent before verified TLS is established: the host secret travels only to the host's https route, the service-role key only to the https database endpoint, both under Node's default verification. https://github.com/Juli1artha/discovery-media-player/blob/main/docs/THREAT-MODEL.md

Every release carries its Sigstore bundle (*.sigstore.json) and the npm package is published with provenance; docs/VERIFYING-RELEASES.md gives the exact commands, the expected output, and the signing identity to require. Signing uses Sigstore's keyless flow, so no private key sits on any distribution site. Scorecard attests it independently (Signed-Releases 8/10). https://github.com/Juli1artha/discovery-media-player/blob/main/docs/VERIFYING-RELEASES.md

Tags are not signed, deliberately: the tag is a human gesture (docs/RELEASING.md), and trust flows through the attestation of the content — Sigstore bundle and npm provenance — which is stronger than a tag signature. https://github.com/Juli1artha/discovery-media-player/blob/main/docs/RELEASING.md

Untrusted inputs are validated by allow-lists and the validators are themselves tested (mutation-verified benches): the SSRF allow-list, sessions bound to their document, bounds on client-supplied values, validated workflow inputs. https://github.com/Juli1artha/discovery-media-player/blob/main/docs/THREAT-MODEL.md

Nonce-based CSP (a bypass is a declared vulnerability), fail-closed behaviour, HMAC with timingSafeEqual, per-address caps on every sensitive route. https://github.com/Juli1artha/discovery-media-player/blob/main/SECURITY.md

docs/THREAT-MODEL.md is the assurance case: threats organized by asset, trust boundaries (the host seam), a measure-per-threat argument that secure design principles are applied and common weaknesses countered — and the residual risks named, the part most assurance cases omit. https://github.com/Juli1artha/discovery-media-player/blob/main/docs/THREAT-MODEL.md

CodeQL with the JavaScript/TypeScript security suites runs on every push, every pull request, and weekly. https://github.com/Juli1artha/discovery-media-player/blob/main/.github/workflows/codeql.yml

No memory-unsafe language in the produced software: no native addon, no FFI — nothing a memory-safety tool could observe. (A ZAP dynamic scan runs in CI regardless.)