zscalerctl

Every workflow declares least-privilege permissions at the top level (contents: read default), so any job without its own permissions block inherits the restricted set, not the repository default. Scorecard's Token-Permissions check scores 10/10.

Every release gets a unique vMAJOR.MINOR.PATCH tag computed by the release workflow, which refuses to proceed if the tag already exists on a different commit.

Each GitHub release carries an auto-generated "What's Changed" log of merged PRs; the versioning policy (docs/VERSIONING.md) requires security-relevant changes (e.g. redaction behavior) to be called out in the notes.

Dependencies are ingested exclusively through standardized tooling: Go modules with go.sum hash verification (vendored in-repo), pip with --require-hashes for the one Python tool, and SHA-pinned GitHub Actions.

Every release publishes SHA256SUMS covering all assets, and a GitHub build-provenance attestation (Sigstore-signed, generated in the release workflow) covers that checksum manifest — verifiable with gh attestation verify.

docs/DEPENDENCY_POLICY.md documents how dependencies are selected, pinned, vendored, hash-verified, and tracked (Renovate for routine updates, with per-module ownership documented).

README and docs/INSTALL.md document the build (go install ./cmd/zscalerctl); all library dependencies are vendored in-repo, so the only build requirement is the Go toolchain.

SECURITY.md's "Project Roles" section documents that the repository owner is the sole person with privileged access.

SECURITY.md documents the single-maintainer role set: development, review (enforced via the required CI gate), release approval, and security response.

The README "Contributing" section states acceptance requirements: discuss in an issue first, pass make check, carry exactly one semver:* label, and include tests for new functionality.

All contributions arrive through GitHub, whose Terms of Service (§D.6, "inbound=outbound") require every contributor to have the right to license their contribution under the repository's license as a condition of contributing.

Branch protection on main requires the aggregate required status check to pass before merge, with "include administrators" enabled — there is no silent bypass path.

Every PR must pass the full automated suite before merge: go test ./... plus the race detector across all packages, vet/staticcheck/govulncheck/semgrep, and secret scanning, aggregated into the required CI check.

docs/ARCHITECTURE.md documents the system's components and data path, and docs/THREAT_MODEL.md explicitly enumerates the actors, trust boundaries, and controls.

All external interfaces are documented: the CLI surface and stable exit codes (README + man page), every resource (docs/RESOURCES.md), machine-readable output contracts as published JSON Schemas (docs/schema/), and the Zscaler API boundary (docs/ARCHITECTURE.md).

The project maintains a written security assessment in docs/THREAT_MODEL.md (objectives, actors, boundaries, controls, scope decisions) and docs/DATA_CLASSIFICATION.md, supplemented by continuous SAST (CodeQL, gosec, semgrep) and weekly fuzzing of the redaction/projection core.

SECURITY.md documents the coordinated disclosure policy: private reporting channel, 7-day acknowledgment, 14-day initial assessment, public disclosure via GitHub Security Advisories.

SECURITY.md provides a private reporting channel (email) directly to the security contact, with explicit instructions not to open public issues.

No vulnerabilities have been discovered to date; SECURITY.md commits to publishing fixed vulnerabilities via GitHub Security Advisories and identifying them in release notes.