Blanc

Verified 2026-09-04: GitHub account security shows two-factor authentication Enabled and required for bnfy. The repository collaborator API lists bnfy as its sole human collaborator/administrator. Sensitive repository changes therefore require an MFA-protected maintainer account. Recheck before adding collaborators.

The authoritative repository is owned by the GitHub personal account bnfy, its sole human collaborator as verified on 2026-09-04. GitHub requires the owner to explicitly invite a selected person before collaborator access is granted; there is no automatic collaborator enrollment. Personal repositories offer owner and collaborator roles, so this relies on manual assignment, not a claim of granular read-only collaborator roles. Platform documentation: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/repository-access-and-collaboration/inviting-collaborators-to-a-personal-repository

Main branch protection enabled and independently read back on 2026-09-04: pull requests required, enforce_admins=true, four required GitHub Actions checks with strict up-to-date checking. Direct main pushes are blocked, including administrators. The approval count is zero for the sole-maintainer project; independent human review is not claimed.

Main branch protection read back from the GitHub API on 2026-09-04 has allow_deletions.enabled=false and enforce_admins.enabled=true. Deletion is blocked while the rule is enabled. The criterion implementation guidance explicitly accepts branch protection that prevents deletion.

No untrusted metadata is consumed by custom pipeline commands in the five workflows reviewed at main 8d4599bca2b8380da1e1c74c2df28cbcbdd83aea: https://github.com/bnfy/blanc/tree/8d4599bca2b8380da1e1c74c2df28cbcbdd83aea/.github/workflows . PR titles, bodies, messages and external branch names are not interpolated into run scripts. Checkout uses the platform-selected PR merge ref. Manual release inputs are supplied by trusted collaborators; the Baseline addresses these separately in OSPS-BR-01.04. Release-tag environment transport hardening is pending in PR #288 and is not claimed as merged. Reassess this N/A if workflows begin consuming untrusted metadata.

Reviewed all five authoritative workflows at https://github.com/bnfy/blanc/tree/8d4599bca2b8380da1e1c74c2df28cbcbdd83aea/.github/workflows . Outside contributions use pull_request on GitHub-hosted runners; there is no pull_request_target, workflow_run artifact execution, or self-hosted runner. GitHub withholds repository secrets and restricts fork PR tokens to read-only: https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target . Build/test PR jobs explicitly use contents:read; CodeQL analyzes without executing a project build. Signing secrets and publication grants are confined to the manually dispatched native workflow, requiring trusted collaborator action on reviewed code. Repository API verified default_workflow_permissions=read and can_approve_pull_request_reviews=false on 2026-09-04. This does not claim build/sign job separation or an independent human review.

Project URLs use HTTPS exclusively.

Distribution channels use HTTPS exclusively.

GitHub repository security settings verified on 2026-09-04 show secret_scanning and secret_scanning_push_protection enabled for bnfy/blanc. These prevent pushes of recognized secret types; this does not claim detection of every secret.

Published in merged PR #285, commit daf4663cc778cb278fc1179ef869a3a906b4ac94: https://github.com/bnfy/blanc/blob/main/docs/user-guide.md . Covers installation, navigation, tabs/groups/workspaces, favorites/imports/history/downloads, private browsing, blocking, permissions, profiles/sync, start-page options, updates and help. The companion docs/user-guide-evidence.md maps the guide to public v1.15.0 source and release evidence.

Public defect reports use https://github.com/bnfy/blanc/issues and the bug report form at https://github.com/bnfy/blanc/blob/main/.github/ISSUE_TEMPLATE/bug_report.yml . Security issues are reported privately using SECURITY.md.

GitHub supports public discussions on proposed changes (via pull requests) and usage obstacles (via issues).

Published contribution process: https://github.com/bnfy/blanc/blob/main/CONTRIBUTING.md . Covers reports, development setup, validation, pull requests/review, licensing and conduct. Merged in PR #285 at daf4663cc778cb278fc1179ef869a3a906b4ac94 on 2026-09-04.

Bananify Creative-owned software is MIT-licensed: https://github.com/bnfy/blanc/blob/main/LICENSE . Upstream components retain their own licenses; identity artwork remains reserved. See THIRD-PARTY-NOTICES.md and ASSET-LICENSE.md in the same repository.

Bananify Creative-owned software is MIT-licensed: https://github.com/bnfy/blanc/blob/main/LICENSE . Third-party components retain their own terms and identity artwork is reserved; see https://github.com/bnfy/blanc/blob/main/THIRD-PARTY-NOTICES.md and https://github.com/bnfy/blanc/blob/main/ASSET-LICENSE.md . This is not a blanket MIT claim for every repository asset. [floss_license]

License file found in repository.

Main software license: https://github.com/bnfy/blanc/blob/main/LICENSE . Reserved identity artwork: https://github.com/bnfy/blanc/blob/main/ASSET-LICENSE.md . Upstream terms: https://github.com/bnfy/blanc/blob/main/THIRD-PARTY-NOTICES.md [license_location]

Repository is publicly available on GitHub.

Repository git metadata is publicly available on GitHub.

Direct npm dependencies are listed in https://github.com/bnfy/blanc/blob/v1.15.0/package.json with package-lock.json recording the resolved dependency tree.

Project owner Anthony Loria confirmed on 2026-09-04 that https://github.com/bnfy/blanc is the only first-party Blanc code repository, including private services/apps. Desktop source, website and sync/ping/newsletter Worker sources are in this repository; no Git submodules are present. The multi-repository requirement is therefore not applicable. Reassess if any additional first-party repository is introduced.

PR #289 merged at 3046d173cd30a5713bd0ef1b7707dc0a14d5223b removes the generated blocker seed binary from Git. npm ci/install regenerates it from pinned sources and requires an exact match with the tracked manifest before writing. See https://github.com/bnfy/blanc/blob/main/docs/blocker-seed-build.md . The reviewed complete merged tree has no native executables, shared libraries, WASM, native addons, application archives, bytecode or minified JavaScript artifacts. Reviewable generated source and media assets remain. CI, Windows/Linux packaged-payload validation and local signed macOS first-run checks passed. The owner-machine confirmation waiver is recorded in docs/release-incidents/2026-09-04-badge-seed-waiver.md; no new public release is claimed.

Reviewed tracked artifacts on 2026-09-04. No native executables, shared libraries, WASM, Electron archives or dependency archives were found. Media/fonts are reviewable assets with provenance in THIRD-PARTY-NOTICES.md. The Apple provisioning profile is CMS/plist-decodable and checked by scripts/preflight-mac-signing.mjs and scripts/after-sign-verify.js. The blocker seed is reproducible from pinned tracked filter/resource inputs using https://github.com/bnfy/blanc/blob/main/adblock/seed.mjs ; npm run adblock:check verified exact regeneration (108342 rules; 5404689-byte seed, hash prefix 194ddc2d204c13b9). This establishes reviewability, not the separate generated-executable criterion.

Published SECURITY.md gives the private reporting address, information to include, response targets, and disclosure process: https://github.com/bnfy/blanc/blob/main/SECURITY.md [vulnerability_report_process]