Security

#

Supply-chain and application-security posture for dominicusin.github.io.

Code scanning (CodeQL)

#

• Alerts: 0 (as of 2026-08-20). 8 src/ alerts fixed in code; 11 scripts/ alerts closed as won't fix (build-time utilities, covered by codeql-config.yml paths-ignore).
• Config: .github/codeql/codeql-config.yml.

Secret scanning

#

• Resolved: Firebase web config is public-by-design (false positive).
• Gitleaks runs in security-scan.yml.

Attestations (SLSA)

#

• actions/attest@v4.2.2 (Generate Generic Attestations) runs on:
  • sbom.yml — attests the generated SBOM (sbom.spdx.json).
  • hugo.yml — attests the built site artifact (./public).

Dependency hygiene

#

• Dependabot active (dependabot.yml).
• dependency-review.yml blocks PRs introducing new vulnerabilities.
• license-check.yml enforces a permissive license allowlist.

Hardening notes

#

• DA0 contracts compile/test under Hardhat 2.x (3.x breaks the CommonJS config + chai-matchers). See issue #202 / milestone “CI/CD Hardening”.
• Deploy DAO contracts and Fortify AST Scan are gated on secrets and skip gracefully when absent (non-blocking).