Potential fix for code scanning alert no. 2: Workflow does not contain permissions - #3
Closed
WejdanBa-CS wants to merge 32 commits into
Closed
Potential fix for code scanning alert no. 2: Workflow does not contain permissions#3WejdanBa-CS wants to merge 32 commits into
WejdanBa-CS wants to merge 32 commits into
Conversation
… HMAC Add scattered LSB embedding for image and audio watermarks with legacy sequential fallback on extract. Extend payloads with optional HMAC claim signatures (alg/kid/version) and ClaimStatus evaluation. PDF and video fingerprinting now store contentBytes, inject comment claims before EOF, append uuid boxes for video, and verify via ClaimCrypto structural signing with originalLength/contentBytes integrity checks. Co-authored-by: Wejdan Al Amri <WejdanBa-CS@users.noreply.github.com>
- Load AccountClaimKeys.current() before embed/verify on all four tools - Pass claimKey into embed/verify APIs; use claimBanner for StatusBanner - History verified flag uses claimCountsAsVerified - Show Key id detail row (kid or legacy) - Soften encrypted copy to signed/ownership language - Update prototype notes for scattered LSB, trailing PDF comment, uuid atom Co-authored-by: Wejdan Al Amri <WejdanBa-CS@users.noreply.github.com>
Add the missing LSB scatter module, fix claim authenticity helpers, and expand core tests for account-bound HMAC and hardened carriers. Co-authored-by: Wejdan Al Amri <WejdanBa-CS@users.noreply.github.com>
Creators can publish fingerprints after protect, scan public media URLs for Signata marks, keep a watchlist of sightings, and optionally sync claims to a remote registry. Co-authored-by: Wejdan Al Amri <WejdanBa-CS@users.noreply.github.com>
Fingerprinted files can be saved with a Download button, and ownership fields no longer prefill Studio Nova. Co-authored-by: Wejdan Al Amri <WejdanBa-CS@users.noreply.github.com>
Upgrade email password hashing to PBKDF2-HMAC-SHA256, store sessions in Flutter Secure Storage, enforce stronger passwords, rate-limit failed attempts, and avoid account-enumeration error messages. Co-authored-by: Wejdan Al Amri <WejdanBa-CS@users.noreply.github.com>
Let users share media from those apps into Signata, batch-fingerprint it, and post protected copies back. Restyle Trace with a radar hero, platform cards, and a sighting timeline.
Let users paste a Web client ID without rebuilding, and correct the MP4 uuid walker so fingerprint round-trips pass.
Cover media, auth, trace, and report paths end-to-end, and wrap EmCard in Material so ListTiles paint ink correctly.
Fix share buffering, per-user stores, commit-on-success freemium, account wipe/recovery, and honest local activation while aligning Home and PDPL copy with the shipped model.
Prefer shared/local media checks over post links, warn before URL fallback, and steer protect/share copy toward Share into Signata.
Let creators restore claim keys and configure Google Sign-In on device, and expand the Play smoke checklist with a debug runner.
Bump to 1.2.4+10 for the next Play upload.
Publish Signata source for portfolio transparency with proprietary terms, responsible disclosure policy, and Flutter test workflow on main.
Match Givy protection posture: Wejdan Al Amri attribution in app footers, in-app and hosted terms with IP section, and manual CI dispatch.
Fail CI on leaked credential patterns in tracked files; document local-only OAuth and keystore handling.
Include home, capabilities, tools, and Trace captures under docs/screenshots and link them from the README and release checklist.
Add safe URL validation, trace rate limiting, and OWASP control docs aligned with Givy.
OWASP hardening for Trace and claim registry
…n permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Potential fix for https://github.com/WejdanBa-CS/Signata/security/code-scanning/2
Add an explicit workflow-level
permissionsblock so every job gets least-privilege token scope by default.For this workflow, the best fix is to add:
permissions:contents: readat the top level (after triggers and before
jobs:is typical). This covers bothtestandsecretsjobs, both of which only need repository read access foractions/checkoutand local commands. No job-specific overrides, imports, methods, or dependency changes are needed.Suggested fixes powered by Copilot Autofix. Review carefully before merging.