Security-Phoenix-demo / blue-shield-firewall

Vollständig aufgelöster Abhängigkeitssatz aus dem GitHub-Abhängigkeitsgraphen: 23 direkte und 21 indirekte (transitive) Pakete. Die transitive Hülle ist vollständig, wenn das Repository eine Lockfile eincheckt.

Dieses Repository veröffentlicht kein vom Index auflösbares Paket, daher wurde sein eigener Abhängigkeitsgraph bewertet – 25 Pakete, darunter auch Entwicklungs- und Test-Pins, die nie ausgeliefert werden: 2 tragen bekannte Advisories, davon 0 direkte. 19 konnten nicht bewertet werden – keine aufgelöste Version, ein nicht unterstütztes Ökosystem, oder außerhalb der ausgewiesenen Paketliste.

Ein Advisory bedeutet, dass die im Abhängigkeitsgraphen erfasste Version in den betroffenen Bereich eines Advisories fällt. Erreichbarkeit wird nicht analysiert, und der Graph enthält Entwicklungs- und Test-Pins — ein Fund kann das Werkzeug betreffen und nicht die ausgelieferte Software.

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 19439,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "Go": 367788,
        "Rust": 83414,
        "Shell": 11877,
        "Groovy": 3286,
        "Makefile": 3669,
        "PowerShell": 4927
      },
      "pushed_at": "2026-07-23T15:26:49Z",
      "created_at": "2026-04-09T08:08:57Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-23T15:27:32Z",
      "description": "Phoenix Supply Chain Firewall — intelligence-driven package security for CI/CD",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go",
        "Rust"
      ]
    },
    "owner": {
      "blog": "www.phoenix.security",
      "name": "Phoenix Security Public",
      "type": "Organization",
      "login": "Security-Phoenix-demo",
      "company": null,
      "location": "London",
      "followers": 16,
      "avatar_url": "https://avatars.githubusercontent.com/u/79762943?v=4",
      "created_at": "2021-02-27T17:53:58Z",
      "is_verified": null,
      "public_repos": 97,
      "account_age_days": 1972
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.4.5",
          "kind": "patch",
          "published_at": "2026-07-23T15:29:01Z"
        },
        {
          "tag": "v0.4.4",
          "kind": "patch",
          "published_at": "2026-07-18T21:01:57Z"
        },
        {
          "tag": "v0.4.1",
          "kind": "patch",
          "published_at": "2026-07-18T19:40:13Z"
        },
        {
          "tag": "v0.4.3",
          "kind": "patch",
          "published_at": "2026-07-18T19:24:14Z"
        },
        {
          "tag": "v0.4.2",
          "kind": "patch",
          "published_at": "2026-07-18T17:00:18Z"
        },
        {
          "tag": "v0.4.0",
          "kind": "minor",
          "published_at": "2026-07-09T09:53:11Z"
        },
        {
          "tag": "v0.3.2",
          "kind": "patch",
          "published_at": "2026-06-30T17:16:29Z"
        },
        {
          "tag": "v0.3.1",
          "kind": "patch",
          "published_at": "2026-06-20T06:17:21Z"
        },
        {
          "tag": "v0.3.0",
          "kind": "minor",
          "published_at": "2026-06-03T08:20:34Z"
        },
        {
          "tag": "v0.2.0",
          "kind": "minor",
          "published_at": "2026-06-01T18:47:19Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "47989325b14448f8520a5ec7d8044bda5f5f00bf",
          "body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: update CHANGELOG for v0.4.5",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-07-23T15:26:29Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "2aa13489c353755e08d108b7d56474e09d9be083",
          "body": "runEnroll config tests hit real hosts (api.example.test, phxintel.security)\nand relied on the old best-effort code swallowing failures. The auth-fatal\nenroll change turns the real backend's 401 into a hard error, breaking\nTestRunEnroll_TenantIDTopLevelWithSectionedConfig. Point both tests at an\nhttptest mock so they no longer touch the network (and no longer generate\n\"tls: bad certificate\" noise in a running proxy).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "test: make enroll config tests hermetic",
          "author_name": "Alfonso Eusebio",
          "author_login": null,
          "committed_at": "2026-07-22T17:00:56Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "1b705e6a33af6f2719aa4b3c86d15397a90beb7a",
          "body": "- evaluate: Check() now calls /api/v1/firewall/agent/evaluate with the\n  single-package body + device_id and x-api-key. It was hitting the human/JWT\n  /evaluate route -> 401 -> the firewall silently failed open on every package.\n- heartbeat: distinguish an auth rejection (401/403) from an unreachabl\n[…]\ney in agent.toml (new client.APIError).\n- env: implement the advertised `phoenix-firewall env` command (the proxy banner\n  told users to run it but it never existed); prints proxy + per-PM CA exports.",
          "is_bot": false,
          "headline": "fix: agent evaluate endpoint, enroll safety, heartbeat diagnostics",
          "author_name": "Alfonso Eusebio",
          "author_login": null,
          "committed_at": "2026-07-22T16:50:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "09071dfc412eda63b24a3acaef383071e2955161",
          "body": "The agent heartbeat payload violated the backend contract three ways, so\nevery heartbeat was rejected (422) and devices never appeared online:\n  - missing required uptime_seconds\n  - integrity SHA256s hashed hardcoded /usr/local/bin + /etc paths that do\n    not exist in a userland install, so they w\n[…]\nst a local backend: the live agent now gets HTTP 200,\nlast_seen_at advances, and a heartbeat row lands with a real integrity hash.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: endpoint heartbeats succeed + report real agent version",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-07-18T21:00:02Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "86369d592b021eb29d17de61f5738318c6489389",
          "body": "After `phoenix-firewall enroll`, agent.toml stores a phx_fwagent_ device\nkey. The rules API (GET /api/v1/firewall/rules) only accepts phx_fw_\nself-service keys, phx_whk_ webhook keys, or a JWT, so `rules list` -- which\nreads api_key from config -- sent the agent key and surfaced an opaque\n401 \"Authe\n[…]\nics only; no API/auth change. The --api-url fallback to agent.toml\nalready works via viper config precedence and needed no change.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: rules list gives actionable error for device agent keys",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-07-18T19:22:08Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5d1a58594b026a7f97f4010f1fb12902db71497b",
          "body": "The interception shim is generated for every supported package manager\nunconditionally (including cargo when Rust is absent). Since the shim dir\nis prepended to PATH, command -v resolves to the shim, so build backends\ntake the tool build path and then hit the shim, which exited 127 with a\nphoenix-br\n[…]\nely missing. Shims are still generated for all PMs by design --\nconditional generation would leave a later-installed PM unproxied.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: shim reports missing PM as command-not-found, not firewall error",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-07-18T16:58:14Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "4fa5e54f85cff10f6ff93c0b0675083d296018c9",
          "body": "…version)\n\nThe userland `phoenix-firewall enroll --api-key <key>` path called a legacy\nclient method that marshalled only device_id + metadata, so the v4 backend\nrejected enrollment with 422 (missing bootstrap_token, hostname, platform,\nagent_version).\n\nBoth enrollment paths now build the complete E\n[…]\nw-dead helper; tests assert the full payload is sent and bootstrap_token is\nomitted when empty.\n\nBumps phoenix-firewall to v0.4.1.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: enroll --api-key sends full v4 payload (hostname/platform/agent_…",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-07-09T22:17:05Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d0761f83c2216e375968d7cfcd05a7c3f6a51c5c",
          "body": "Folds in everything merged since v0.3.2 that wasn't yet documented: tenant_id\npropagation, configurable proxy port, --test-mode lifecycle-script deny,\ndirect-install bypass detection, the canary test fixture, the npm :443\nmatcher fix, the Makefile ldflags fix, and the golang.org/x/net security bump\n(PR #10). Updates the release date and adds known-gap notes for Yarn Classic\nscript-deny coverage and the open low-severity Rust lru advisory.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: update CHANGELOG for v0.4.0",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-07-09T09:49:51Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "b0008c607fe361782934f85c1ed699d25df10a93",
          "body": "…es/go_modules-1c6fc88cd1\n\nchore(deps): bump the go_modules group across 2 directories with 1 update",
          "is_bot": false,
          "headline": "Merge pull request #10 from Security-Phoenix-demo/dependabot/go_modul…",
          "author_name": "Francesco Cipollone",
          "author_login": "franksec42",
          "committed_at": "2026-07-09T09:47:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b3c3be2b614557d44e52e9897cf5ca547262b194",
          "body": "…date\n\nBumps the go_modules group with 1 update in the / directory: [golang.org/x/net](https://github.com/golang/net).\nBumps the go_modules group with 1 update in the /phoenix-firewall directory: [golang.org/x/net](https://github.com/golang/net).\n\n\nUpdates `golang.org/x/net` from 0.43.0 to 0.55.0\n- \n[…]\ny-group: go_modules\n- dependency-name: golang.org/x/net\n  dependency-version: 0.55.0\n  dependency-type: indirect\n  dependency-group: go_modules\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the go_modules group across 2 directories with 1 up…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-04T06:16:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6057935b79c64e8b2e03058b54e2398f09c55f00",
          "body": "cmd/version.go declares lowercase unexported version/commit/date vars, but\nthe Makefile's -X flags targeted cmd.Version/cmd.GitCommit/cmd.BuildDate,\nwhich don't exist -- go build silently no-ops unmatched -X paths instead of\nerroring, so `make build`/`make build-all` always shipped \"dev\n(commit: unk\n[…]\naser.yml already used the correct lowercase names; only the plain\nMakefile was stale. Found while rebuilding the binary after merging PR #7/#8.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: correct ldflags symbol names in Makefile build/build-all targets",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-07-02T14:46:16Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c8bbed56d0b80838d7ee780275d1280fa384290c",
          "body": "…opagation\n\nfeat: containment for host-executed test packages (npm script deny + …",
          "is_bot": false,
          "headline": "Merge pull request #8 from Security-Phoenix-demo/fix/tenant-id-org-pr…",
          "author_name": "Francesco Cipollone",
          "author_login": "franksec42",
          "committed_at": "2026-07-02T14:37:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ee7db45d9bde8e83ddd7a87defa902225f3bd9c8",
          "body": "Local-only test fixture that reproduces the shape of the anthropic-toolkit\nincident's postinstall TTP (lifecycle script -> DNS lookup -> outbound HTTPS\ncall) with none of the actual risk: no filesystem access, no credential/SSH\nreads, no data collection, always exits 0. Not wired into any build/CI p\n[…]\nguarantees and usage (npm pack + install only inside a disposable,\nnetwork-isolated environment, beaconing only to infrastructure you control).\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "test: add safe canary npm package fixture (postinstall network beacon)",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-07-02T14:36:41Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "bbba8d4564ba8c647f3c6d25957d8db2000a4f33",
          "body": "…bypass detection)\n\nIncident follow-up: a package's lifecycle script executed on a host during\ntesting. Two containment/detection controls, scoped to this repo:\n\n1. `phoenix-firewall init --test-mode` bakes an unconditional\n   npm_config_ignore_scripts=true (npm/pnpm — Yarn Classic doesn't reliably\n\n[…]\noss-compiles\n(118 tests), plus an end-to-end functional test that actually runs a\ngenerated bash shim and confirms bypass.log is written.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>\nEOF\n)",
          "is_bot": false,
          "headline": "feat: containment for host-executed test packages (npm script deny + …",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-07-02T13:52:06Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "57ee8869bec4dff434fe72d2e4367ef0642be981",
          "body": "…opagation\n\nFix/tenant id org propagation",
          "is_bot": false,
          "headline": "Merge pull request #7 from Security-Phoenix-demo/fix/tenant-id-org-pr…",
          "author_name": "Francesco Cipollone",
          "author_login": "franksec42",
          "committed_at": "2026-07-02T08:53:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ee3fb65ed8e2643adc165974f64532f6d52283b2",
          "body": "…ess URL handling, test coverage)\n\n- cmd/init_cmd.go, cmd/config_helpers.go: reject/ignore proxy_port values\n  outside 1-65535 instead of writing an unusable value to agent.toml.\n- internal/proxy/handler.go: stripDefaultPort now preserves bracketed IPv6\n  literals (was dropping brackets via u.Hostna\n[…]\nthe\n  package manager being run) and add the unset step, with a pointer to the\n  per-command scoped pattern in docs/LOCAL_PROXY_ALIAS_GUIDE.md.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: address PR #7 bot review findings (port validation, IPv6/schemel…",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-07-02T08:53:24Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "26edf1713a5ef24f7e21d3f340b54b788cb7caa8",
          "body": "The override guard only checked the CLI flag's Changed(\"port\"), missing\nenv-var-sourced values from viper.AutomaticEnv(). PHOENIX_PORT=<port> with\nno --port flag was silently clobbered by agent.toml's proxy_port, inverting\nthe intended flag/env > file precedence. Use viper.IsSet(\"port\") instead,\nmatching the sibling strict_mode/enforce_policy_freshness checks in the same\nfunction.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: proxy_port TOML override must respect PHOENIX_PORT env var",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-07-01T15:28:49Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "178c38533ca32406b3a14d08901fb2f51447b9a5",
          "body": "InstallPATH() hardcoded port 8080 in the Generator struct, so shims\nalways probed 127.0.0.1:8080 regardless of the port configured via\n--proxy-port or agent.toml. This caused the identity handshake to fail\non non-default ports (e.g. 28090 to avoid Docker conflicts).\n\nFix: add proxyPort int parameter to InstallPATH on darwin, linux, and\nwindows. init_cmd.go passes the resolved port so generated shims match\nthe actual proxy listen port.\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: thread proxy_port into shim generator on all platforms",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-07-01T12:32:09Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "a85af200e90ee4acde88cff25c0b7db988e2e9ab",
          "body": "New enrollment fields (tenant_id, device_id, hostname, etc.) were appended\nat end-of-file. When a pre-existing agent.toml already contained [policy] or\n[fail_mode] sections, the appended keys fell inside those tables and became\ninvisible to viper.GetString(\"tenant_id\"), so the proxy started with no\n\n[…]\nonfig.\n- TestRunEnroll_TenantIDTopLevelWithSectionedConfig: end-to-end enroll\n  against a pre-existing init-style config, verified via viper.\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: upsertTOMLLine inserts new keys before first [section] header",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-07-01T12:32:02Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3fad9815b94dc8b2888ae61188064c7810e2517f",
          "body": "…pagation\n\n# Conflicts:\n#\tcmd/init_cmd.go",
          "is_bot": false,
          "headline": "Merge remote-tracking branch 'origin/main' into fix/tenant-id-org-pro…",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-07-01T11:40:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b7d127711c6881ff75fc5edfb0135deb2a2f1775",
          "body": "…tripping\n\n- proxy_port in agent.toml now overrides the default 8080 when --port is not\n  explicitly passed; fixes conflicts with Docker and other services that bind\n  8080; phoenix-firewall init accepts --proxy-port flag and writes the value\n  into agent.toml and agent-bridge.json\n- handler.go: str\n[…]\n\n- Fix default API URL: api.phxintel.security → phxintel.security (the\n  api. subdomain does not resolve; backend lives at phxintel.security)\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: configurable proxy port via agent.toml + npm matcher :443 port s…",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-07-01T11:17:41Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "745eb4cf09c32114ce17536a9b669da0bd6cd91e",
          "body": "…tbeat robustness\n\n- TestWithTenantID_NilReceiver: nil receiver returns nil, no panic\n- TestWithTenantID_ClonesClient: clone is a new pointer; original unchanged\n- TestCheck_TenantIDWired: tenant_id present in evaluate payload when set,\n  absent when not set (omitempty)\n- TestStartEndpointHeartbeat_\n[…]\nxercises without panic\n- TestStartEndpointHeartbeat_StopCalledConcurrently: 10 concurrent stop calls,\n  no panic (sync.Once regression guard)\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "test: add unit tests for WithTenantID nil guard, tenant_id wire, hear…",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-06-30T18:01:12Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "03fd930786be19ccccbd56f4614bca9e72828370",
          "body": "…opagation\n\nfix: thread tenant_id from enrollment through to evaluate + heartbeat",
          "is_bot": false,
          "headline": "Merge pull request #6 from Security-Phoenix-demo/fix/tenant-id-org-pr…",
          "author_name": "Francesco Cipollone",
          "author_login": "franksec42",
          "committed_at": "2026-06-30T17:58:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ee43288ce544e84e6d1ab5930b1be0c03ce1fab3",
          "body": "… comment accuracy\n\n- WithTenantID: add nil receiver check to prevent panic on chained nil client\n- startEndpointHeartbeat: add nil cfg guard; enforce 10s minimum heartbeat\n  interval to prevent accidental backend flooding; remove legacy\n  PHOENIX_TENANT_ID env fallback (cfg.TenantID is the single s\n[…]\nnstead\n  of !cfg.Bool so that --strict-mode=false / PHOENIX_STRICT_MODE=false cannot\n  be silently overwritten by agent.toml strict_mode=true\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: address code review – nil guards, idempotent stop, min interval,…",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-06-30T17:25:07Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0a99cb5099417853a998bb80f1576ad72bd4a183",
          "body": "Previously, `tenant_id` written to agent.toml at enroll time was\nsilently dropped — Config had no field for it, so every subsequent\ncommand (proxy, system, heartbeat, package check) ran without org\ncontext and the backend could not apply org-scoped rules.\n\nChanges:\n- internal/config/config.go: add T\n[…]\n client\n\nNote: --tenant-id is optional at enroll. The API key carries org_id\nserver-side; tenant_id in payloads is a compatibility hint only.\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: thread tenant_id from enrollment through to evaluate + heartbeat",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-06-30T17:15:26Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d414d63c982a5f0dd467e69c0db7a806cf1c88b9",
          "body": "…-failmode-enrollment\n\nfeat: proxy identity handshake, fail-mode wiring, backend enrollment (v0.4.0)",
          "is_bot": false,
          "headline": "Merge pull request #5 from Security-Phoenix-demo/feat/proxy-handshake…",
          "author_name": "Francesco Cipollone",
          "author_login": "franksec42",
          "committed_at": "2026-06-21T18:25:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "21a3a075e47fb710c02f1d002fb1d04c157f484f",
          "body": "- Guard c.Enroll() with BootstrapToken == \"\" to prevent double-POST on one-time tokens (cmd/enroll.go)\n- Add h.recordResult() before blockResponse() in fail-closed path so reporter captures blocked packages (internal/proxy/handler.go)\n- Add //go:build !windows constraint to shim integration tests (i\n[…]\nically confirm\" → \"confirm (via identity marker)\" (CHANGELOG.md)\n- Bump INSTALL.md version references from v0.2.0 to v0.4.0 (docs/INSTALL.md)\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(firewall): address PR review critical and medium findings",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-06-21T17:50:22Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "34e160d3e51cc049f15b73470a2359f4534a40ef",
          "body": null,
          "is_bot": false,
          "headline": "Merge branch 'main' into feat/proxy-handshake-failmode-enrollment",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-06-20T22:57:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3208e65209c9551de9d4842c05c37e690efde43e",
          "body": "install.sh — macOS/Linux userland installer: downloads the correct\nphoenix-firewall binary from GitHub Releases, verifies the checksum,\ninstalls to ~/.local/bin, and runs `phoenix-firewall init`.\n\ninstall.ps1 — Windows PowerShell equivalent: downloads from the same\nReleases URL, verifies SHA-256, installs to %LOCALAPPDATA%\\PhoenixFirewall,\nadds to user PATH, and runs init.\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: add cross-platform install scripts",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-06-20T22:45:10Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "fc2e8e5fcd0aa077073d9699c32aea22c147e192",
          "body": "- Add CHANGELOG.md covering v0.4.0 (proxy handshake, fail-mode,\n  enrollment, rules cmd), v0.3.0 (security hardening), v0.2.0, v0.1.0\n- Add cmd/rules.go: `phoenix-firewall rules list` fetches rules from\n  GET /api/v1/firewall/rules with --limit/--offset/--json flags\n- Add docs/INSTALL.md and docs/LOCAL_PROXY_ALIAS_GUIDE.md\n- Bump internal/version.Agent: 0.1.0 → 0.4.0\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): v0.4.0 — CHANGELOG, rules subcommand, version bump",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-06-20T08:00:27Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "8ba252f41b5d70e875a8921908bd77eee83d8292",
          "body": "…indows fail-mode, enroll chmod)\n\n- heartbeat: treat HTTP 4xx/5xx as send errors (OnResult(false) on 401/503 —\n  backend was falsely reported as reachable when auth was rejected)\n- heartbeat: use version.Agent instead of hardcoded \"0.1.0\"\n- heartbeat: fileHash() now opens+reads the file; falls back \n[…]\ne\n(no HTTP identity handshake); _SHIM_DIR hardcoded in bash template; nested\nPUB-firewall/phoenix-firewall/ duplicate requires manual rm -rf.\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(firewall): resolve final-review findings (heartbeat, integrity, w…",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-06-19T19:35:09Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9fa0c7af3f43697189ab8d00448e401e30b8370d",
          "body": "…s failures\n\n- client.Enroll() POSTs device_id + metadata to /api/v1/firewall/agent/enroll,\n  sending bootstrap token (if provided) or existing API key as Bearer auth\n- enroll command accepts --bootstrap-token as alternative to --api-key;\n  either one satisfies the requirement, both absent → clear e\n[…]\n_id auto-derived from hostname when not provided; persisted to agent.toml\n- host metadata (hostname, os, arch) sent to backend at enroll time\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(firewall): enroll registers device with backend and reports comm…",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-06-19T19:12:14Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b454f67982b50a39a7512858a09029fe77e02d73",
          "body": "InstallPATH(failMode string) now carries the configured fail mode from\nagent.toml into Generator.FailMode so it is baked into each shim script\nat install time. readFailMode() reads fail_mode.mode via viper (already\npopulated by initConfig) and normalises to \"open\"/\"closed\".\n\nPreviously InstallPATH() took no argument so all shims silently defaulted\nto fail_mode=open regardless of config.\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(firewall): wire fail_mode through InstallPATH into shim generator",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-06-19T19:10:07Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "44e823b8733142514e51c839cc99e13f8019fab7",
          "body": "…listener warning\n\n- Shim performs HTTP identity handshake on /__phoenix/health; verifies\n  \"service\":\"phoenix-firewall\" marker — a bare TCP listener on the proxy\n  port is no longer trusted (fixes the Docker-on-8080 false-proxy bug)\n- Warns to stderr when a foreign process occupies the port (handsh\n[…]\nacross darwin/linux/windows\n- Integration tests: VerifiedProxy, ForeignListenerWarnsFailOpen,\n  ForeignListenerFailClosedBlocks — all 3 green\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(firewall): shim HTTP identity handshake, fail-mode, and foreign-…",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-06-19T19:06:27Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f1bf17709d0646f60086b06e651aebf1dabd2944",
          "body": "… comms failure",
          "is_bot": false,
          "headline": "feat(firewall): report backend reachability via heartbeat and warn on…",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-06-19T18:25:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3ed8978b7b026c7453d39c76f053aea6fdf08d47",
          "body": "Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(firewall): honor fail_mode (closed blocks) on backend API error",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-06-19T18:19:35Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "45f0c01fcbb76ef5261308924ba6f3b59780a769",
          "body": "Add FailMode field to Config struct with failModeOrDefault helper\n(defaults to \"open\"). Wire initConfig to read ~/.config/phoenix-firewall/agent.toml\nand bind PHOENIX_FAIL_MODE env to fail_mode.mode. viper precedence\npreserved: flags > env > config file > default.\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(firewall): read agent.toml and expose FailMode in config",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-06-19T18:13:19Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "b2511fbb8b3582a69ec5e52a16bca0256e225cea",
          "body": "Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(firewall): add proxy identity/health endpoint for shim handshake",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-06-19T18:08:20Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "1b9aa9503d58e8a970ac433d50b19f757fc474e2",
          "body": "Readme ca changes",
          "is_bot": false,
          "headline": "Merge pull request #4 from Security-Phoenix-demo/readme-CA-changes",
          "author_name": "Francesco Cipollone",
          "author_login": "franksec42",
          "committed_at": "2026-06-17T18:20:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "32c3f05f8b342b75a6c6fe3da1ba4f9af9d7c5cf",
          "body": null,
          "is_bot": false,
          "headline": "proxy change to correct CA",
          "author_name": "Miguel Reid Ruiz",
          "author_login": "MiguelReidRuiz",
          "committed_at": "2026-06-16T07:53:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3f0a4fb38e358491835c5a0f1410fd68e3fde32f",
          "body": null,
          "is_bot": false,
          "headline": "base URL changes",
          "author_name": "Miguel Reid Ruiz",
          "author_login": "MiguelReidRuiz",
          "committed_at": "2026-06-16T07:47:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c5bae2768a78e4db475e595b1c94d1578539a126",
          "body": null,
          "is_bot": false,
          "headline": "base URL change",
          "author_name": "Miguel Reid Ruiz",
          "author_login": "MiguelReidRuiz",
          "committed_at": "2026-06-16T07:38:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7add6e356ba3a82435b8676e196f7e96fe751db4",
          "body": null,
          "is_bot": false,
          "headline": "feat: add endpoint identity registration metadata",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-06-14T11:25:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9a38d03805310ce5b0dbec127dca02e5d51e3b73",
          "body": null,
          "is_bot": false,
          "headline": "feat: add endpoint inventory collector support",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-06-14T01:52:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a90dbc1dfd926cc2cb761343d15131c286125229",
          "body": "…followups\n\nfix(proxy): address shellenv PR #2 review follow-ups",
          "is_bot": false,
          "headline": "Merge pull request #3 from Security-Phoenix-demo/fix/shellenv-review-…",
          "author_name": "Francesco Cipollone",
          "author_login": "franksec42",
          "committed_at": "2026-06-12T15:34:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7d9fdf79d8d519b154cf60efd3095d0f8572df7c",
          "body": "Robustness fixes from the Gemini/Copilot review of the merged\nshell-export feature (PR #2):\n\n- Resolve --ca-dir to an absolute path (filepath.Abs) so emitted\n  CA-cert vars survive a later cwd change (e.g. during package installs)\n- Validate --shell up front and error on unsupported values instead o\n[…]\n- Sync --shell help text in env and proxy commands to the full list\n- Update PowerShell test assertion; add unsupported-shell test\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(proxy): address shellenv PR #2 review follow-ups",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-06-12T15:24:49Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "fa8374eb6ec8a8bfaf9464132f84e63b6ed99c45",
          "body": "feat(proxy): shell-export mode (env / proxy --print-exports) to route package managers through the proxy",
          "is_bot": false,
          "headline": "Merge pull request #2 from Security-Phoenix-demo/feat/proxy-shellenv",
          "author_name": "Francesco Cipollone",
          "author_login": "franksec42",
          "committed_at": "2026-06-12T14:00:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ee215fd7a2ba14046a4e2afb2a9998d8a3fbd8b8",
          "body": "…-renaming\n\nNaming changed from phoenix-firewall to blue-shield-firewall",
          "is_bot": false,
          "headline": "Merge pull request #1 from Security-Phoenix-demo/blue-shield-firewall…",
          "author_name": "Francesco Cipollone",
          "author_login": "franksec42",
          "committed_at": "2026-06-12T13:59:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "92ada623dd95e5044312e3cd73641c329e6db4f7",
          "body": "…gh the proxy\n\nAdds `phoenix-firewall env` (alias `shellenv`) and a `proxy --print-exports`\nflag that emit eval'able HTTP(S)_PROXY + CA-trust env exports, so callers can:\n\n  eval \"$(phoenix-firewall env)\"            # bash/zsh\n  phoenix-firewall env --shell fish | source\n  eval \"$(phoenix-firewall p\n[…]\nt the proxy. The proxy now also prints an eval hint on startup.\nSupports posix/fish/powershell syntax and --unset. Adds cmd tests.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(proxy): add shell-export mode for routing package managers throu…",
          "author_name": "franksec42",
          "author_login": "Securitypohoenix",
          "committed_at": "2026-06-12T12:47:09Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "10b4b68b0b2613839c80f2d946cd0b6f037cdfab",
          "body": null,
          "is_bot": false,
          "headline": "Update install.ps1",
          "author_name": "Miguel Reid Ruiz",
          "author_login": "MiguelReidRuiz",
          "committed_at": "2026-06-08T10:30:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d6671372c0ba1f8ad1c1ff8c3599abe147582c79",
          "body": null,
          "is_bot": false,
          "headline": "Correct phoenix-firewall route within blue-shield-firewall",
          "author_name": "Miguel Reid Ruiz",
          "author_login": "MiguelReidRuiz",
          "committed_at": "2026-06-08T10:22:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a66210d957a9bf674d28116de27462a2af78a092",
          "body": "…curity-Phoenix-demo/blue-shield-firewall into blue-shield-firewall-renaming",
          "is_bot": false,
          "headline": "Merge branch 'blue-shield-firewall-renaming' of https://github.com/Se…",
          "author_name": "Miguel Reid Ruiz",
          "author_login": "MiguelReidRuiz",
          "committed_at": "2026-06-08T10:16:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b9e68f7db13f87460c2cc6bed59389a80c89b71a",
          "body": null,
          "is_bot": false,
          "headline": "Update Makefile",
          "author_name": "Miguel Reid Ruiz",
          "author_login": "MiguelReidRuiz",
          "committed_at": "2026-06-08T10:15:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "851a78ef44583f9a01deb0024057b8914c71f9b9",
          "body": "Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Update phoenix-firewall/main.go",
          "author_name": "MiguelReidRuiz",
          "author_login": "MiguelReidRuiz",
          "committed_at": "2026-06-08T10:14:29Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "b478977175cd5a3cf6554f689ffbf99ecb183b0a",
          "body": "Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Update phoenix-firewall/go.mod",
          "author_name": "MiguelReidRuiz",
          "author_login": "MiguelReidRuiz",
          "committed_at": "2026-06-08T10:14:00Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "8853345feee7ee1e949e80cfd4266ba70cc2e05d",
          "body": null,
          "is_bot": false,
          "headline": "Naming changed from phoenix-firewall to blue-shield-firewall",
          "author_name": "Miguel Reid Ruiz",
          "author_login": "MiguelReidRuiz",
          "committed_at": "2026-06-08T10:10:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "eb502842d5fee7972272c8e6ea9c35bbcb84cdfc",
          "body": "goreleaser v2.16 no longer accepts --skip=build. Collapse the two-step\nbuild+publish flow into a single 'goreleaser release --clean' that builds,\ncosign-signs, and publishes atomically. Azure Trusted Signing remains as\nan optional post-publish step (continue-on-error) for when cert procurement\ncompletes.",
          "is_bot": false,
          "headline": "fix: single goreleaser release call; --skip=build removed in v2.16",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-06-03T08:18:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a49f66254f98f88404137172e42ff8d70c36150a",
          "body": "secrets.AZURE_TENANT_ID cannot be referenced in a step if: expression —\ncaused the workflow to fail to parse (zero jobs). Use continue-on-error\nalone; Azure action fails gracefully when secrets are absent.",
          "is_bot": false,
          "headline": "fix: remove invalid secrets context from step if-condition",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-06-03T08:15:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b129fdc458612322993d135c8d616ba318f2f659",
          "body": "…ecation\n\n- Azure Trusted Signing step now skipped when AZURE_TENANT_ID secret is\n  absent (continue-on-error + secrets check), so publish is no longer\n  blocked when Azure credentials are not configured\n- Recompute checksums only when Azure signing actually ran (avoids\n  invalidating the cosign signature on checksums.txt)\n- Fix goreleaser release.github.name: phoenix-firewall → blue-shield-firewall\n- Fix goreleaser archives.format_overrides.format deprecation: use formats[]",
          "is_bot": false,
          "headline": "fix: workflow Azure signing gate + goreleaser repo name + format depr…",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-06-03T08:13:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "84979f2298138f9f87697ac6643d99925e33844c",
          "body": "goreleaser requires a clean working tree. Stale pre-built binaries in\ndist/ were tracked, causing the release workflow to fail with \"git is in\na dirty state\". Remove them from the index and expand the .gitignore\nrule to cover the entire dist/ directory that goreleaser owns.",
          "is_bot": false,
          "headline": "chore: remove tracked dist/ binaries, gitignore dist/ for goreleaser",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-06-03T08:09:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "514c2b23cc427b4d0496d74c169d61ba34df0e78",
          "body": null,
          "is_bot": false,
          "headline": "Update session-context.txt",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-06-03T07:48:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3f5b499728a9c5fe4462d4e1aa730ea3f4cfaaae",
          "body": "Introduce a server-authorized bypass subcommand and supporting helpers/tests, and overhaul the release pipeline and documentation. New cobra command `bypass verify` and agent config helpers (with tests) enforce fail-closed behavior for shim bypass tokens. GitHub Actions release workflow replaced wit\n[…]\n default proxy port changed to 8080, updated download URLs, checksum & verification guidance), and prebuilt dist artifacts + checksums and various internal proxy/client/proxy tests were added/updated.",
          "is_bot": false,
          "headline": "Add bypass cmd, release workflow, and docs updates",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-06-03T07:46:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6187a83cd755568cf6a1d74dd6a57740dd76904e",
          "body": "…x-demo\n\nThe repo was transferred from nicokoenig to Security-Phoenix-demo on GitHub.\nHalf the codebase (committed in this session) already used the new path;\nthe remaining files still referenced github.com/nicokoenig/phoenix-firewall,\nleaving the module in an inconsistent state flagged by Codex adv\n[…]\noenix-firewall/ nested module:\n  go.mod, all *.go imports, Makefile, cmd/version.go\n\nAll 100 tests pass across both modules after the rename.\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor: complete module path migration nicokoenig → Security-Phoeni…",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-05-11T20:48:38Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c369f2e8b01bf537e518b227358996f9392efb46",
          "body": "…management\n\nagent-bridge fallback:\n- agentBridgeFallback() now calls /api/v1/firewall/evaluate via\n  internal/client instead of always returning allow\n- Extracts package name from --package flag or parses it from the\n  --command string (e.g. \"npm install lodash@1.2.3\")\n- Handles npm scoped packages\n[…]\n(launchctl load / systemctl enable --now)\n- system stop: deactivate running service\n- system status: surfaces OS-native service status output\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(agent-bridge,system): implement fallback evaluation and service …",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-05-11T19:12:17Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1e4a748b031b466cfb29f32643c8d6d97431ca43",
          "body": "The three-layer interception model was broken: shims called agent-bridge\ninstead of exec'ing the real PM, the system command never started the\nproxy, and the CA was never generated at init time.\n\n- internal/shim/generator.go: rewrite bash template to walk PATH\n  (skipping shim dir), probe 127.0.0.1:\n[…]\nSIGTERM/SIGINT\n\n- cmd/init_cmd.go: generate MITM CA at init time; add proxy_port (8080)\n  and ca_path to agent-bridge.json for hook discovery\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(proxy): wire userland MITM proxy and fix shim interception",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-05-11T18:19:13Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e15c3a3859feccfc97a3ede549c914a479ce4182",
          "body": "…nstallation, CLI reference\n\n- Two-mode comparison table (proxy vs endpoint/shim)\n- Proxy mode 7-step MITM walkthrough with registry coverage\n- Endpoint/shim mode flow diagram and quick start\n- Full installation guide (binary/Windows/source/homebrew)\n- Endpoint mode setup: init → enroll → system ins\n[…]\n- Security properties comparison table\n- CI/CD integration examples (GitHub Actions, GitLab CI)\n- Relationship to phoenix-firewall-agents-hub\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: comprehensive README covering proxy mode, endpoint/shim mode, i…",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-05-11T18:01:07Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9a0e8e0839051ba6235d107784554f71245ef6ad",
          "body": "… ED25519 bypass tokens, B7.0 enroll subcommand\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(scf-v4/userland): B4 LaunchAgent/systemd-user/schtasks, B5 local…",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-05-11T17:41:11Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "1efe34cff919ac6bdc1a5b40a6b228647bb8fbc8",
          "body": "…mmand, agent-bridge home-dir discovery\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(scf-v4/userland): B2 — userland shims (~/.local/bin), init subco…",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-05-11T17:40:17Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "56d33f17e08a5d138f3c72ddddf651530193e0d2",
          "body": "…ed release, checksums, SBOM\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(scf-v4/userland): B6 goreleaser pipeline — cross-platform unsign…",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-05-11T17:40:12Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "ebe9b3cd56510f53d71a7e7ee58674458d21a092",
          "body": "…rvice/shim/policy/telemetry/integrity/bypass/mdm packages\n\nAdds PS-SCF v4 endpoint-mode skeleton: system cobra subcommand (install/uninstall/status), agent-bridge subcommand (local-worker routing with backend fallback), OS-native service manager interface (launchd/systemd/SCM stubs), PATH shim gene\n[…]\nn bypass token validator (R-FUNC-067), and MDM compliance writer interface (JAMF/JSON/WMI stubs). All packages build and vet clean on darwin.\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(scf-v4): B1+B2-B7 scaffold — system/agent-bridge subcommands, se…",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-05-11T17:14:59Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "36fb5c7d6fa7c26d7f4694ed3e2856c521c6a9cc",
          "body": "Add configurable registry support so the proxy can intercept packages\nfrom GitLab package registries (both gitlab.com and self-hosted) and\narbitrary custom registry domains, in addition to the existing npm,\nPyPI, Cargo, Gem, and Maven public registries.\n\nNew CLI flags / env vars:\n  --gitlab-hosts / \n[…]\nonfigurable custom registry matcher\n  integrations/gitlab-ci/examples/gitlab-registry.gitlab-ci.yml\n\n12 new tests, all 37 passing.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: add GitLab package registry + custom registry interception",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-04-17T05:39:29Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7bb3892266f5022f016d61bf28532c7c5d611078",
          "body": "Introduce the Phoenix Supply Chain Firewall project and accompanying GitHub Action. Adds CLI/proxy implementation, client/registry integrations, reporter, CA handling, tests, and helper code under phoenix-firewall (Go and Rust sources), plus build tooling (Makefile, .goreleaser.yml, Cargo.toml), LIC\n[…]\nDME and usage examples, CI release workflow, and example workflow files demonstrating strict/harden-runner and basic usage. This changebootstraps the project for local/CI usage and release automation.",
          "is_bot": false,
          "headline": "Add Phoenix firewall project and GitHub Action",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-04-16T14:05:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "35e763706be60f910ce35b4654fd448fd7f80c06",
          "body": "- Jenkins: shared library (vars/phoenixFirewall.groovy) + Jenkinsfile examples\n- Azure DevOps: pipeline template with parameters + artifact publishing\n- Bitbucket: pipe definition + inline script examples\n- All integrations: binary download, CI mode, report generation, basic/strict examples\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: add Jenkins, Azure DevOps, and Bitbucket CI integrations",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-04-09T10:34:20Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "c81ee99ea53bc5387f697537c4a09866e7894d76",
          "body": "- install.sh: universal curl-pipe-bash installer with SHA256 verification\n- check-lockfile.sh: standalone lockfile check (no proxy, just API call)\n- Supports: package-lock.json, requirements.txt (more coming)\n- README: added CI/CD integrations table with all 6 platforms\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: add generic CI installer + lockfile checker + update README",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-04-09T10:33:35Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "383ea908211bf73b9fc334b9acf9f59506a25338",
          "body": "…github-action/, add GitLab CI\n\n- Moved action/ → integrations/github-action/ for multi-CI repo structure\n- GitLab CI: includable template (phoenix-firewall.yml) with auto-detection\n- GitLab CI: variable-based config matching GitHub Action inputs\n- GitLab CI: artifacts + dotenv report for downstream jobs\n- Examples: basic + strict mode for GitLab\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor: restructure CI integrations — move action/ to integrations/…",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-04-09T10:32:08Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "6211b5e59ad7f0ec12acf7888e00fec6293f0fc1",
          "body": "Intelligence-driven package firewall for CI/CD pipelines.\nPowered by Phoenix Security MPI — 52 heuristic rules, dual-LLM adversarial detection.\n\nComponents:\n- Go MITM proxy (cmd/, internal/) — production proxy with CA generation, registry interception, LRU cache\n- Rust proxy scaffold (src/) — next-g\n[…]\nwhen API unreachable\n- JSON report output with per-package verdicts\n\nApache 2.0 — clean-room implementation, no AGPL dependencies.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: Phoenix Supply Chain Firewall v0.1.0",
          "author_name": "franksec42",
          "author_login": "franksec42",
          "committed_at": "2026-04-09T08:17:01Z",
          "body_truncated": true,
          "is_coding_agent": true
        }
      ],
      "releases_count": 10,
      "commits_last_year": 76,
      "latest_release_at": "2026-07-23T15:29:01Z",
      "latest_release_tag": "v0.4.5",
      "releases_from_tags": false,
      "days_since_last_push": 1,
      "active_weeks_last_year": 11,
      "days_since_latest_release": 1,
      "mean_days_between_releases": 5.8
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 50,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/Security-Phoenix-demo/blue-shield-firewall",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/Security-Phoenix-demo/blue-shield-firewall",
          "is_deprecated": false,
          "latest_version": "v0.4.5",
          "repository_url": "https://github.com/Security-Phoenix-demo/blue-shield-firewall",
          "versions_count": 10,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-23T15:26:29Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 1
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 0,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_stars": 0,
        "collected_at": null
      },
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile",
        "phoenix-firewall/Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "Cargo.toml",
        "go.mod",
        "phoenix-firewall/Cargo.toml",
        "phoenix-firewall/go.mod"
      ],
      "largest_source_bytes": 32338,
      "source_files_sampled": 119,
      "oversized_source_files": 0,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "Cargo.toml",
        "go.mod",
        "phoenix-firewall/Cargo.toml",
        "phoenix-firewall/go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "golang.org/x/net",
            "direct": false,
            "version": "v0.55.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5942"
            ],
            "fixed_version": "0.56.0",
            "advisory_count": 1,
            "oldest_advisory_days": 10
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.37.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5970"
            ],
            "fixed_version": "0.39.0",
            "advisory_count": 1,
            "oldest_advisory_days": 10
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "unknown": 2
        },
        "advisory_count": 2,
        "affected_count": 2,
        "assessed_count": 25,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 19,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "crates",
        "go"
      ],
      "dependencies": [
        {
          "name": "clap",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "4"
        },
        {
          "name": "tokio",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "hyper",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "hyper-util",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.1"
        },
        {
          "name": "http-body-util",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.1"
        },
        {
          "name": "bytes",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "rustls",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.23"
        },
        {
          "name": "rustls-pemfile",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "2"
        },
        {
          "name": "rcgen",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.13"
        },
        {
          "name": "tokio-rustls",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.26"
        },
        {
          "name": "reqwest",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.12"
        },
        {
          "name": "serde",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "serde_json",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "tracing",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.1"
        },
        {
          "name": "tracing-subscriber",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.3"
        },
        {
          "name": "lru",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.12"
        },
        {
          "name": "url",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "2"
        },
        {
          "name": "anyhow",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "time",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.3"
        },
        {
          "name": "github.com/elazarl/goproxy",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.3"
        },
        {
          "name": "github.com/spf13/cobra",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.1"
        },
        {
          "name": "github.com/spf13/viper",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.19.0"
        },
        {
          "name": "clap",
          "manifest": "phoenix-firewall/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "4"
        },
        {
          "name": "tokio",
          "manifest": "phoenix-firewall/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "hyper",
          "manifest": "phoenix-firewall/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "hyper-util",
          "manifest": "phoenix-firewall/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.1"
        },
        {
          "name": "http-body-util",
          "manifest": "phoenix-firewall/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.1"
        },
        {
          "name": "bytes",
          "manifest": "phoenix-firewall/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "rustls",
          "manifest": "phoenix-firewall/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.23"
        },
        {
          "name": "rustls-pemfile",
          "manifest": "phoenix-firewall/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "2"
        },
        {
          "name": "rcgen",
          "manifest": "phoenix-firewall/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.13"
        },
        {
          "name": "tokio-rustls",
          "manifest": "phoenix-firewall/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.26"
        },
        {
          "name": "reqwest",
          "manifest": "phoenix-firewall/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.12"
        },
        {
          "name": "serde",
          "manifest": "phoenix-firewall/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "serde_json",
          "manifest": "phoenix-firewall/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "tracing",
          "manifest": "phoenix-firewall/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.1"
        },
        {
          "name": "tracing-subscriber",
          "manifest": "phoenix-firewall/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.3"
        },
        {
          "name": "lru",
          "manifest": "phoenix-firewall/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.12"
        },
        {
          "name": "url",
          "manifest": "phoenix-firewall/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "2"
        },
        {
          "name": "anyhow",
          "manifest": "phoenix-firewall/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "time",
          "manifest": "phoenix-firewall/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.3"
        },
        {
          "name": "github.com/Security-Phoenix-demo/phoenix-firewall",
          "manifest": "phoenix-firewall/go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.3.0"
        },
        {
          "name": "github.com/elazarl/goproxy",
          "manifest": "phoenix-firewall/go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.3"
        },
        {
          "name": "github.com/spf13/cobra",
          "manifest": "phoenix-firewall/go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.1"
        },
        {
          "name": "github.com/spf13/viper",
          "manifest": "phoenix-firewall/go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.19.0"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "anyhow",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "bytes",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "clap",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "http-body-util",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "hyper",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "hyper-util",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "lru",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "rcgen",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "reqwest",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "rustls",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "rustls-pemfile",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "serde",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "serde_json",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "time",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "tokio",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "tokio-rustls",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "tracing",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "tracing-subscriber",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "url",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "github.com/elazarl/goproxy",
            "direct": true,
            "version": "v1.8.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/security-phoenix-demo/phoenix-firewall",
            "direct": true,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cobra",
            "direct": true,
            "version": "v1.8.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/viper",
            "direct": true,
            "version": "v1.19.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fsnotify/fsnotify",
            "direct": false,
            "version": "v1.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/hcl",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/inconshreveable/mousetrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/magiconair/properties",
            "direct": false,
            "version": "v1.8.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/mapstructure",
            "direct": false,
            "version": "v1.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pelletier/go-toml/v2",
            "direct": false,
            "version": "v2.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sagikazarmark/locafero",
            "direct": false,
            "version": "v0.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sagikazarmark/slog-shim",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sourcegraph/conc",
            "direct": false,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/afero",
            "direct": false,
            "version": "v1.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cast",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/pflag",
            "direct": false,
            "version": "v1.0.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/subosito/gotenv",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/atomic",
            "direct": false,
            "version": "v1.9.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/multierr",
            "direct": false,
            "version": "v1.9.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/exp",
            "direct": false,
            "version": "v0.0.0-20230905200255-921286631fa9",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/net",
            "direct": false,
            "version": "v0.55.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.45.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.37.0",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/ini.v1",
            "direct": false,
            "version": "v1.67.0",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v3",
            "direct": false,
            "version": "v3.0.1",
            "ecosystem": "go"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 44,
        "direct_count": 23,
        "indirect_count": 21
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 9,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 1
      },
      "bus_factor": 1,
      "bot_contributors": 1,
      "top_contributors": [
        {
          "type": "User",
          "login": "franksec42",
          "commits": 62,
          "avatar_url": "https://avatars.githubusercontent.com/u/60008926?v=4"
        },
        {
          "type": "User",
          "login": "MiguelReidRuiz",
          "commits": 10,
          "avatar_url": "https://avatars.githubusercontent.com/u/280416062?v=4"
        },
        {
          "type": "User",
          "login": "Securitypohoenix",
          "commits": 1,
          "avatar_url": "https://avatars.githubusercontent.com/u/163278972?v=4"
        }
      ],
      "contributors_sampled": 3,
      "top_contributor_share": 0.849
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "release.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 9,
            "reason": "binaries present in source code",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 5,
            "reason": "branch protection is not maximal on development and all release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 2,
            "reason": "1 out of 5 merged PRs checked by a CI test -- score normalized to 2",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/13 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 3,
            "reason": "project has 1 contributing companies or organizations -- score normalized to 3",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 10,
            "reason": "5 out of the last 5 releases have a total of 10 signed artifacts.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 8,
            "reason": "2 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "47989325b14448f8520a5ec7d8044bda5f5f00bf",
        "ran_at": "2026-07-24T17:45:38Z",
        "aggregate_score": 5.5,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-23T15:30:42Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": "2026-07-09T09:47:06Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/Security-Phoenix-demo/blue-shield-firewall",
    "host": "github.com",
    "name": "blue-shield-firewall",
    "owner": "Security-Phoenix-demo"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 59,
      "inputs": {
        "security": 64,
        "vitality": 82,
        "community": 24,
        "governance": 58,
        "engineering": 61
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 82,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "good",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 70,
            "inputs": {
              "commits_last_year": 76,
              "human_commit_share": 0.987,
              "days_since_last_push": 1,
              "active_weeks_last_year": 11
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 1 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 1
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "11/52 weeks with commits",
                "points": 7.6,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 11
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "76 commits in the last year",
                "points": 16.9,
                "status": "partial",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 76
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "releases_count": 10,
              "latest_release_tag": "v0.4.5",
              "releases_from_tags": false,
              "days_since_latest_release": 1,
              "mean_days_between_releases": 5.8
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "10 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 10
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 1 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 1
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~5.8 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 5.8
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "5 out of the last 5 releases have a total of 10 signed artifacts.",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "critical",
        "name": "Community & Adoption",
        "value": 24,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 0,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "0 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 58,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 20,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 3,
              "top_contributor_share": 0.849
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 85% of commits",
                "points": 3.4,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 85
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "3 contributors",
                "points": 4.1,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 3,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "moderate",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 65,
            "inputs": {
              "merged_prs": 9,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 1
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "9/10 decided PRs merged",
                "points": 34.4,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 9,
                      "decided": 10
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/13 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 63,
            "inputs": {
              "followers": 16,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "Security-Phoenix-demo",
              "public_repos": 97,
              "account_age_days": 1972
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "16 followers of Security-Phoenix-demo",
                "points": 8.8,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 16,
                      "login": "Security-Phoenix-demo"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "97 public repos, account ~5 yr old",
                "points": 23.8,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 97
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 5
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "github.com/Security-Phoenix-demo/blue-shield-firewall"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 1
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 1 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 1
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "10 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 10
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "moderate",
        "name": "Engineering Quality",
        "value": 61,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "moderate",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 52,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "1 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "1 out of 5 merged PRs checked by a CI test -- score normalized to 2",
                "points": 4,
                "status": "partial",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "good",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 75,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 64,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "moderate",
            "name": "Security posture",
            "note": null,
            "notes": [],
            "value": 55,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 18,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 0,
              "scorecard_aggregate": 5.5
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "binaries present in source code",
                "points": 6.8,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection is not maximal on development and all release branches",
                "points": 3.8,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "1 out of 5 merged PRs checked by a CI test -- score normalized to 2",
                "points": 0.5,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/13 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 0.8,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "5 out of the last 5 releases have a total of 10 signed artifacts.",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "2 existing vulnerabilities detected",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 25 resolved dependencies against OSV; 19 could not be assessed (no resolved version, an unsupported ecosystem, or beyond the reported package list). This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories",
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 25
                }
              },
              {
                "code": "advisories_unassessed",
                "params": {
                  "count": 19
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 2,
              "affected_packages": 2,
              "assessed_packages": 25,
              "unassessed_packages": 19,
              "affected_by_severity": "unknown 2",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 25,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 2
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 65,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.853,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "64 of 75 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 64,
                      "sampled": 75
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "good",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 79,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum"
              ],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile",
                "phoenix-firewall/Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [],
              "agent_commit_share": 0.592,
              "toolchain_manifests": [
                "Cargo.toml",
                "go.mod",
                "phoenix-firewall/Cargo.toml",
                "phoenix-firewall/go.mod"
              ],
              "dependency_bot_commit_share": 0.013
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile, phoenix-firewall/Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile, phoenix-firewall/Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "45 of the last 76 commits agent-authored or agent-credited",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 45,
                      "sampled": 76
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "1 of the last 76 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 1,
                      "sampled": 76
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 32338,
              "source_files_sampled": 119,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/119 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 119,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "at_risk",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Could not fetch crates package 'phoenix-firewall' from its registry"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-24T17:45:53.195790Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/s/Security-Phoenix-demo/blue-shield-firewall.svg",
  "full_name": "Security-Phoenix-demo/blue-shield-firewall",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}