Files

T

Palash DebnathandClaude Opus 4.8 8162f52c08 ci(security): scanning workflow + CodeRabbit config + sweep design (PR 0) (#135 )

* ci(security): add scanning workflow + CodeRabbit config + sweep design

PR 0 of the v0.3.0 stabilization sweep — establishes the automated
review + security gate every subsequent plan PR flows through.

- .github/workflows/security.yml: gitleaks (gating secret scan),
  CodeQL (Python + JS/TS), bandit (SARIF), pip-audit + bun audit.
  Only the secret scan gates; dep/SAST findings are reporting-only
  to stay consistent with the no-ceremony, continuous-to-main cadence.
- .coderabbit.yaml: path filters + constitution constraints encoded as
  review instructions (local-first, cross-platform parity, alembic,
  no secret/home-path leakage). Drafts excluded from auto-review.
- SECURITY.md: document the automated scanning + bot review.
- docs/specs: program design for the full sweep (plan-01..05 + PR triage).

CodeRabbit and Greptile apps are already installed and will review on
PR open.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* ci(security): install bandit[sarif] extra; pin JS actions to Node 24

The bandit SARIF formatter ships in the `bandit[sarif]` extra; plain
`bandit` rejects `-f sarif` (exit 2), so no SARIF was written and the
upload step failed. Install via `pipx run --spec 'bandit[sarif]'`.

Also add FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 (mirrors ci.yml) to silence
the Node 20 deprecation warning on checkout/setup-python/upload-sarif.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* ci(security): harden per bot review — persist-credentials, upload guard, bun pin

Addresses CodeRabbit + Greptile findings on #135:
- persist-credentials: false on all checkout steps (don't leave GITHUB_TOKEN
  in git config; none of these jobs need authed git after clone). [CodeRabbit]
- continue-on-error on the bandit SARIF upload so a missing SARIF can't fail
  this reporting-only job. [Greptile P1]
- pin bun-version "1.2" — `bun audit` only exists in bun >=1.2.x. [Greptile P2]

Declined: full-SHA action pinning. Meets the major-tag bar set in
.coderabbit.yaml and matches ci.yml/release.yml convention; SHA pinning
belongs in a repo-wide hardening pass with Dependabot, not one file.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-05-29 08:04:25 +05:30

2.4 KiB

Raw Blame History

Security Policy

Supported Versions

Version	Supported
0.2.x	✅ Current release
< 0.2	❌ No longer supported

Reporting a Vulnerability

Please do not open a public issue for security vulnerabilities.

Instead, report them privately via one of these channels:

GitHub Security Advisories (preferred) — Report a vulnerability
Email — Send details to security@palash.dev

What to include

Description of the vulnerability
Steps to reproduce
Potential impact
Suggested fix (if you have one)

Response timeline

Step	Timeline
Acknowledgment	Within 48 hours
Initial assessment	Within 5 business days
Fix or mitigation	Within 30 days (critical), 90 days (non-critical)
Public disclosure	After fix is released, coordinated with reporter

Scope

OmniVoice Studio runs 100% locally by default. The primary attack surface is:

Network exposure — if the user binds to 0.0.0.0 without a reverse proxy
Model downloads — fetched from Hugging Face Hub over HTTPS
Dependency supply chain — Python/npm packages
File handling — audio/video uploads processed by FFmpeg, torchaudio, etc.

Out of scope

Vulnerabilities in upstream dependencies (PyTorch, FFmpeg, etc.) — report those upstream
Issues requiring physical access to the machine
Social engineering attacks

Automated scanning

Every pull request and push to main runs .github/workflows/security.yml:

gitleaks — secret scanning (blocks merge on a leaked credential)
CodeQL — Python + JavaScript/TypeScript static analysis → Security tab
bandit — Python static analysis → Security tab
pip-audit / bun audit — dependency advisory checks (reporting)

Pull requests are additionally reviewed by the CodeRabbit and Greptile GitHub Apps on creation.

Security Best Practices for Users

Do not expose OmniVoice to the internet without authentication. The API has no built-in auth. Use a reverse proxy (Caddy, nginx, Tailscale) if you need remote access.
Keep your installation updated. The desktop app auto-checks for updates via the built-in updater.
Review model sources. Only download models from trusted Hugging Face repositories.

2.4 KiB Raw Blame History