fix(security): prove GitHub API URL authority - #2279

Merged

seonghobae merged 32 commits into

mainfrom

fix/github-api-url-boundary

Sep 19, 2026

Commits on Sep 19, 2026

test(security): reject noncanonical GitHub API authorities
seonghobae
committed
4732f3e
fix(security): centralize GitHub API URL authority
seonghobae
committed
31b9b9c
fix(security): validate CodeQL GitHub API authority
seonghobae
committed
46aa717
fix(security): validate Strix GitHub API authority
seonghobae
committed
c420afc
fix(security): bind scanner suppression to authority proof
seonghobae
committed
8d7bce4
chore(security): keep standalone URL guards local
seonghobae
committed
9328266
docs(security): doctor GitHub API authority repair
seonghobae
committed
77c1dc2
test(security): prove canonical GitHub API control
seonghobae
committed
9844484
test(security): document URL boundary fixtures
seonghobae
committed
4864f14
docs(security): align URL authority acceptance matrix
seonghobae
committed
cb50c8a
fix(security): bind Semgrep ignore to guarded sink line
seonghobae
committed
9ba43f2
test(security): reject bearer-carrying GitHub redirects
seonghobae
committed
7a00442
fix(security): block authenticated GitHub API redirects
seonghobae
committed
a2e9126
fix(security): block Strix GitHub API redirects
seonghobae
committed
4c7bcbe
test(security): bind URL controls to no-redirect openers
seonghobae
committed
e06b6dd
docs(security): trace GitHub redirect authority repair
seonghobae
committed
8803693
chore(security): restore CodeQL identity rationale comment
seonghobae
committed
daea503
docs(strix): restore truncated-patch fallback rationale
seonghobae
committed
72d6927
test(codeql): bind GHAS transport mocks to dedicated opener
seonghobae
committed
25f83aa
test(security): bind redirect rejection to production openers
seonghobae
committed
5747728
docs(security): record production-opener redirect proof
seonghobae
committed
e0b0b4d
docs(gap): track production-opener redirect proof
seonghobae
committed
033e475
test(strix): bind transport mocks to dedicated opener
seonghobae
committed
663ffac
test(security): close GitHub opener evidence gaps
seonghobae
committed
9c19c6e
test(docs): reject unreachable opener lineage SHAs
seonghobae
committed
1c80086
docs(doctoring): bind opener proof to published commit
seonghobae
committed
bd0f178
docs(gap): record published opener lineage
seonghobae
committed
d63d7e9
test(security): expose vacuous G-17 lineage guard
seonghobae
committed
c37db54
fix(security): verify G-17 evidence commit lineage
seonghobae
committed
b339370
docs(security): trace published evidence lineage validation
seonghobae
committed
b338d1e
test(docs): require foreign evidence owner identity
seonghobae
committed
64f33a8
docs(security): qualify foreign Semgrep evidence owner
seonghobae
committed
d1e4380

Navigation Menu

fix(security): prove GitHub API URL authority - #2279

fix(security): prove GitHub API URL authority#2279
seonghobae merged 32 commits into
mainfrom
fix/github-api-url-boundary

Commits on Sep 19, 2026

test(security): reject noncanonical GitHub API authorities

fix(security): centralize GitHub API URL authority

fix(security): validate CodeQL GitHub API authority

fix(security): validate Strix GitHub API authority

fix(security): bind scanner suppression to authority proof

chore(security): keep standalone URL guards local

docs(security): doctor GitHub API authority repair

test(security): prove canonical GitHub API control

test(security): document URL boundary fixtures

docs(security): align URL authority acceptance matrix

fix(security): bind Semgrep ignore to guarded sink line

test(security): reject bearer-carrying GitHub redirects

fix(security): block authenticated GitHub API redirects

fix(security): block Strix GitHub API redirects

test(security): bind URL controls to no-redirect openers

docs(security): trace GitHub redirect authority repair

chore(security): restore CodeQL identity rationale comment

docs(strix): restore truncated-patch fallback rationale

test(codeql): bind GHAS transport mocks to dedicated opener

test(security): bind redirect rejection to production openers

docs(security): record production-opener redirect proof

docs(gap): track production-opener redirect proof

test(strix): bind transport mocks to dedicated opener

test(security): close GitHub opener evidence gaps

test(docs): reject unreachable opener lineage SHAs

docs(doctoring): bind opener proof to published commit

docs(gap): record published opener lineage

test(security): expose vacuous G-17 lineage guard

fix(security): verify G-17 evidence commit lineage

docs(security): trace published evidence lineage validation

test(docs): require foreign evidence owner identity

docs(security): qualify foreign Semgrep evidence owner