From 167bcbd5f33bc401729e0885be9fd002ac04c943 Mon Sep 17 00:00:00 2001
From: edgepillar <179010287+edgepillar@users.noreply.github.com>
Date: Sun, 23 Aug 2026 09:46:03 +0300
Subject: [PATCH 1/2] chore: add Loupe scanner profile

---
 .loupe/scanner-config.json      | 13 +++++++
 README.md                       |  1 +
 docs/loupe-security-scanning.md | 66 +++++++++++++++++++++++++++++++++
 3 files changed, 80 insertions(+)
 create mode 100644 .loupe/scanner-config.json
 create mode 100644 docs/loupe-security-scanning.md

diff --git a/.loupe/scanner-config.json b/.loupe/scanner-config.json
new file mode 100644
index 0000000..985396f
--- /dev/null
+++ b/.loupe/scanner-config.json
@@ -0,0 +1,13 @@
+{
+  "max_concurrent_files": 4,
+  "include_extensions": ["js", "mjs", "ts", "tsx"],
+  "extra_source_paths": [
+    "src",
+    "scripts/create-four-node-devnet.mjs",
+    "Dockerfile",
+    "docker-compose.yml",
+    "docker-compose.portainer.yml",
+    "docker/caddy/Caddyfile",
+    "vite.config.ts"
+  ]
+}
diff --git a/README.md b/README.md
index 68ea73d..965c3d7 100644
--- a/README.md
+++ b/README.md
@@ -27,6 +27,7 @@ The backend is Node/Express. The frontend is React/Vite and follows the dark, co
 ## Planning Docs
 
 - [Genesis release automation plan](docs/genesis-release-automation-plan.md): proposed event history, configurable `go-zenon` release targets, operator-specific bootstrap scripts, and node polling automation.
+- [Loupe security scanning](docs/loupe-security-scanning.md): guarded repository registration, scanner scope, and baseline/incremental scan commands.
 
 ## Important Security Notes
 
diff --git a/docs/loupe-security-scanning.md b/docs/loupe-security-scanning.md
new file mode 100644
index 0000000..e57eabe
--- /dev/null
+++ b/docs/loupe-security-scanning.md
@@ -0,0 +1,66 @@
+# Loupe Security Scanning
+
+This repository carries a Project Loupe scanner profile at
+`.loupe/scanner-config.json`. The profile covers the TypeScript application
+and the operational files that automatic package-root discovery would not
+normally include, especially the devnet wallet-generation script, container
+definitions, Caddy configuration, and Vite configuration.
+
+## Register the repository
+
+Run these commands from a checkout of this repository after the Loupe server,
+worker, and `loupectl` client are configured:
+
+```bash
+loupectl repo add \
+  --clone-url https://github.com/0x3639/testnet.git \
+  --branch main \
+  --scanner-config-file .loupe/scanner-config.json \
+  --no-reporting \
+  --verification-enabled \
+  --require-approval
+```
+
+The safe initial policy is deliberate:
+
+- `--no-reporting` keeps findings in Loupe for manual triage until a tracker
+  repository and scoped GitHub token are selected.
+- `--verification-enabled` asks a second agent to validate each candidate.
+- `--require-approval` prevents a confirmed finding from being dispatched
+  without an operator decision.
+- No scan interval is set, so the first runs are explicitly controlled and
+  their provider usage can be observed.
+
+The command prints the assigned repository ID. Start the baseline scan with:
+
+```bash
+loupectl repo scan <repo-id>
+```
+
+Inspect progress and results with:
+
+```bash
+loupectl job list
+loupectl finding list <repo-id>
+loupectl finding show <finding-id>
+```
+
+After the baseline completes, scan later changes incrementally:
+
+```bash
+loupectl repo scan <repo-id> --incremental
+```
+
+## Profile lifecycle
+
+Loupe stores the scanner JSON when the repository is registered. If
+`.loupe/scanner-config.json` changes, reload it without discarding prior jobs
+or findings:
+
+```bash
+loupectl repo update <repo-id> \
+  --scanner-config-file .loupe/scanner-config.json
+```
+
+Do not put Loupe credentials, API keys, GitHub tokens, wallet material, or
+testnet operator secrets in this profile.

From 68e7cd4bb14ae997d48064778a5225dc34286020 Mon Sep 17 00:00:00 2001
From: edgepillar <179010287+edgepillar@users.noreply.github.com>
Date: Sun, 13 Sep 2026 14:48:06 +0300
Subject: [PATCH 2/2] chore: refresh Loupe scan profile for current deployment

---
 .loupe/scanner-config.json      | 5 +++--
 docs/loupe-security-scanning.md | 2 ++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/.loupe/scanner-config.json b/.loupe/scanner-config.json
index 985396f..ffb4776 100644
--- a/.loupe/scanner-config.json
+++ b/.loupe/scanner-config.json
@@ -1,12 +1,13 @@
 {
-  "max_concurrent_files": 4,
+  "max_concurrent_files": 1,
   "include_extensions": ["js", "mjs", "ts", "tsx"],
   "extra_source_paths": [
     "src",
     "scripts/create-four-node-devnet.mjs",
     "Dockerfile",
     "docker-compose.yml",
-    "docker-compose.portainer.yml",
+    "docker-compose.coolify.yml",
+    "docker/entrypoint.sh",
     "docker/caddy/Caddyfile",
     "vite.config.ts"
   ]
diff --git a/docs/loupe-security-scanning.md b/docs/loupe-security-scanning.md
index e57eabe..6eecb45 100644
--- a/docs/loupe-security-scanning.md
+++ b/docs/loupe-security-scanning.md
@@ -30,6 +30,8 @@ The safe initial policy is deliberate:
   without an operator decision.
 - No scan interval is set, so the first runs are explicitly controlled and
   their provider usage can be observed.
+- The profile scans one file at a time for the initial baseline to keep
+  provider usage bounded. Increase concurrency only after reviewing that run.
 
 The command prints the assigned repository ID. Start the baseline scan with: