Skip to content

PUBLICATION-AUDIT.md

Latest commit

 

History

History
12 lines (9 loc) · 1.02 KB

PUBLICATION-AUDIT.md

File metadata and controls

12 lines (9 loc) · 1.02 KB
Raw

Publication audit

Audit date: 2026-08-31.

  • All 66 upstream repositories were verified through the GitHub API as public. One (Contrast-Security-OSS/vulnpy) is archived but remains public.
  • Every source checkout was clean and exactly matched the 40-character commit in its ground truth before bundling.
  • The bundle contains no nested .git directories, local environment file, dashboard session, GitHub token, or OpenAI key.
  • Pattern review found one upstream-tracked private key at targets/dsvpwa/ssl/key.pem. It belongs to the public DSVPWA test application and its matching self-signed example certificate; it is deliberately retained as security-test input.
  • One AWS-key-shaped match is encoded font data inside Pillow's public ImageFont.py, not a credential.
  • Upstream copyright and license files remain inside each target. The bundle does not claim to relicense upstream code.

This repository intentionally contains vulnerable code, fake credentials, and security-test artifacts. It must never be deployed as an application.