Kepenk

The authoritative GitHub account is protected with multi-factor authentication, which is required before sensitive repository resources can be accessed or modified.

Collaborator access is granted manually by the repository owner through explicit GitHub invitations. No user receives collaborator access automatically.

The main branch is protected by a GitHub branch protection rule that requires changes to be merged through pull requests and prevents direct commits.

The main branch is protected against deletion. Changing or removing this protection requires an explicit repository administration action and confirmation.

The CI workflows use static commands and do not interpolate pull request titles, branch names, commit messages, issue content, or other untrusted event metadata into executable shell commands.

Pull request workflows use read-only repository permissions, do not receive privileged credentials, and do not expose repository secrets to untrusted code snapshots. Third-party actions are pinned to full commit SHAs.

All official project channels use HTTPS URLs hosted by GitHub.

Official source and release distribution channels use GitHub HTTPS endpoints with authenticated TLS transport.

GitHub secret scanning and push protection are enabled to detect and block supported credentials before they enter the repository. Sensitive key and local-policy paths are excluded by .gitignore, and the contribution and security policies prohibit committing credentials, private keys, tokens, and private logs.

The repository includes a README, adoption guide, integration guides, contributor quickstart, policy examples, demonstrations, and documentation for the released functionality.

Defects can be reported through the repository’s public GitHub Issues page, while security vulnerabilities have a separate private reporting process.

Public GitHub Issues and pull requests provide mechanisms for discussing proposed changes, defects, and usage obstacles.

CONTRIBUTING.md and the contributor quickstart document the contribution process, required checks, issue workflow, pull request expectations, and security restrictions.

The source code is released under the OSI-approved Apache License 2.0.

Released software assets are distributed under the Apache License 2.0.

The complete Apache License 2.0 text is maintained in the repository’s root LICENSE file.

The project release process includes the LICENSE file with the released source code and release assets.

The authoritative source repository is publicly readable at https://github.com/bilgi-ship-it/kepenk.

GitHub provides a publicly readable commit history recording each change, its author, and its timestamp.

Direct runtime dependencies are declared in pyproject.toml. Optional development, MCP, and release dependencies are also listed separately.

Kepenk is maintained as a single authoritative source-code repository, so a multi-repository codebase inventory is not applicable.

Generated executable and packaging artifacts are not stored in version control. Build, dist, virtual environment, cache, and egg-info outputs are excluded through .gitignore, and release artifacts are generated separately.

The authoritative repository contains reviewable source code, text documentation, schemas, policies, tests, and configuration files. It does not intentionally store opaque or unreviewable binary artifacts.

SECURITY.md identifies GitHub Private Vulnerability Reporting through GitHub Security Advisories as the security contact mechanism and explains the information required in a report.