Skip to content

Derive what the root holds, rather than listing it in the security policy [#332] #333

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
iderex merged 1 commit into from
Sep 16, 2026
Merged

Derive what the root holds, rather than listing it in the security policy [#332] #333

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 30 additions & 4 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,10 +36,15 @@ Read the tree before deciding what to look for. The description calls this the
shared core every Flowfin client uses. What it holds is a Rust crate under `src/`
and its suite under `tests/`, decision records under `docs/decisions` and the
index that lists them, GitHub Actions workflows and the shell scripts those
workflows run, a gate-parity document, this file, the licence, a DCO, a notice, a
README, two issue templates with the config beside them, a pull-request template,
a manifest, a lockfile, a toolchain pin, and a `.gitattributes` that fixes the
line ending.
workflows run, a gate-parity document beside those records, two issue templates
and a pull-request template beside those workflows, a register under `security/`
in which every scanner exclusion and every dismissed finding carries a published
statement, and the prose and the settings files at the root, among them the
`.gitattributes` that fixes the line ending. What the root itself holds is read
rather than listed here, for the reason the second paragraph below gives, and the
command returns the register named above along with the files:

git ls-tree --name-only origin/main | grep -v -E '^(src|tests|docs|\.github)$'

THIS PARAGRAPH NAMED NEITHER THE CRATE NOR THE SUITE, AND THE ONE AFTER IT SAID
THE CORE WAS NOT WRITTEN. Both were true when they were written and had stopped
Expand All @@ -61,6 +66,27 @@ count beside it always said to derive it and still does:

git ls-tree -r --name-only origin/main | wc -l

IT DRIFTED AGAIN, THREE TIMES IN THE ELEVEN DAYS AFTER THAT SENTENCE LANDED,
WHICH IS WHY THE FILE-BY-FILE PART OF IT IS DERIVED NOW RATHER THAN EXTENDED. It
named one licence while two texts stand, each of them sufficient on its own,
which is what `README.md` and the notice both say. It named neither the code of
conduct nor the register under `security/`. And it never named `CONTRIBUTING.md`,
which was here before it was written, so that omission is not drift and is the
one the derived line repairs by construction. Each of the three arrivals came in
a change that had no reason to open this paragraph:

git log origin/main --diff-filter=A --format='%h %ad' --date=short \
-- LICENSE-APACHE CODE_OF_CONDUCT.md security/statements.json
89b9102 2026-09-05
a9dfdca 2026-09-04
2939128 2026-09-02

The register is the item that cost the most by being absent. It is where a
scanner exclusion and a dismissed finding are stated publicly rather than
suppressed quietly, so a wrong entry in it is a class nothing looks at and
nothing says so, and a reporter taking this list for the map would not have known
a register of that kind was here.

There are no releases and no tags. How many branches there are moves with every
change in flight, so it is derived here rather than counted:

Expand Down
Loading