deadpoets / secmem

Full resolved dependency set from the GitHub dependency graph: 5 direct and 2 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.

This repository publishes no package the index resolves, so its own dependency graph was assessed — 7 packages, which also include development and test pins that never ship: 1 carry known advisories, of which 1 are direct.

An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.

{
  "data": {
    "repo": {
      "topics": [
        "cryptography",
        "go",
        "golang",
        "hardening",
        "key-management",
        "memory-safety",
        "mlock",
        "secret-management",
        "secrets",
        "secure-memory",
        "security",
        "memfd-secret"
      ],
      "is_fork": false,
      "size_kb": 577,
      "has_wiki": false,
      "homepage": null,
      "languages": {
        "Go": 679364,
        "Assembly": 13785,
        "Makefile": 2495
      },
      "pushed_at": "2026-07-21T00:57:08Z",
      "created_at": "2026-07-12T18:17:03Z",
      "owner_type": "User",
      "updated_at": "2026-07-21T00:56:12Z",
      "description": "Pure-Go off-heap secret memory: mmap/mlock, memfd_secret L4 isolation, guard pages, fail-closed by default",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": null,
      "name": "Chris",
      "type": "User",
      "login": "deadpoets",
      "company": null,
      "location": "Florida",
      "followers": 1,
      "avatar_url": "https://avatars.githubusercontent.com/u/7587613?v=4",
      "created_at": "2014-05-15T02:24:51Z",
      "is_verified": null,
      "public_repos": 20,
      "account_age_days": 4452
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.2.0",
          "kind": "minor",
          "published_at": "2026-07-20T00:43:23Z"
        },
        {
          "tag": "v0.1.0",
          "kind": "minor",
          "published_at": "2026-07-17T00:16:09Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "f006acc0001ce27ba6b1462d66510595b962f5f8",
          "body": "Dependency-only release so **crypto-only consumers get the crash fix**.\n\n`secmem-crypto` v0.1.0 pins `secmem v0.1.0`, so anyone importing only\nthis module still resolves the core that faults the process when a\nmutating call follows `ReadOnly()`. Bumping the `require` propagates the\nfix without touch\n[…]\nn this repo.\n\nTag after merge:\n```\ngit tag -s secmem-crypto/v0.2.0 -m \"...\"\ngit push origin secmem-crypto/v0.2.0\n```\n\n---------\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "build(secmem-crypto): require secmem v0.2.0 (secmem-crypto/v0.2.0) (#40)",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-21T00:56:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "63fbce940d03e79838339bb590a8777c45307d00",
          "body": "Docs-only release prep for **v0.2.0**. No library or test code changes —\nthis is the CHANGELOG cut plus the KERNELS evidence rows, so it can land\nimmediately before tagging.\n\n## Why v0.2.0 now\nv0.1.0 ships a **process-crashing defect**: `ReadOnly()` followed by\n`CopyIn`/`SetByteAt`/`Truncate`/`ReadF\n[…]\nring.\n\n## Not included\nNo tags. `v0.2.0` and the follow-up `secmem-crypto/v0.1.1` are yours to\ncut — immutable refs, no bypass.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "docs: cut the v0.2.0 changelog and record its verified kernels (#39)",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-20T23:39:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4cc2beb83c0d53980a703a04c62f9797c35b3b55",
          "body": "Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.5.0\nto 7.0.0.\n<details>\n<summary>Release notes</summary>\n<p><em>Sourced from <a\nhref=\"https://github.com/actions/setup-go/releases\">actions/setup-go's\nreleases</a>.</em></p>\n<blockquote>\n<h2>v7.0.0</h2>\n<h2>What's Changed</h2>\n<ul>\n[…]\nnless you reopen the\nPR or upgrade to it yourself)\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 (#38)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-20T00:42:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f7fdf4e2872b8c03e50f15b0646ba7944bdaca57",
          "body": "## Summary\n\nFuzzing-maturity follow-ups to #35, motivated by the read-only fault the\nlifecycle fuzzer found.\n\n> **Stacked on #35** — base branch is `fix/readonly-write-fault`,\nbecause this uses that PR's lifecycle fuzzers and its\n`Seal`-on-read-only fix. **Retarget to `main` once #35 merges.**\n\n## W\n[…]\nonce it's on\n`main`; use **Run workflow** (workflow_dispatch, with a tunable\nper-target budget) to trigger it manually anytime.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: nightly fuzzing, seed corpora, and a signer-lifecycle fuzzer (#36)",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-19T20:36:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "535d6a36be1201382f7319be09a3c16ba0c50511",
          "body": "…istic (#37)\n\n## Summary\n\nFixes a flaky test I introduced in #35.\n`TestArena_ConcurrentReadOnlyRelease` failed on **macOS** in CI:\n\n```\nsecurearena_test.go:777: Acquire after stress: secmem: secure arena is full — no free slots\n```\n\n## Cause\n\nThe test let a worker **give up** on a slot after 100 ref\n[…]\nleaving.\n\nNote: #36 (nightly fuzzing) is currently red for this same reason and\nwill go green once this lands — I'll rebase it.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "test: drain refused slots so the arena concurrency stress is determin…",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-19T20:35:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2111fef8fbdb1aa2daa33296b6d4e1816c6fe2c0",
          "body": "…ting (#35)\n\n## Summary\n\n`SecureBuffer.ReadOnly()` sets the region to `PROT_READ`, but the\nmutating methods did not check for it — so a write issued after\n`ReadOnly()` reached the read-only page and **crashed the process with\nSIGSEGV**, violating the \"misuse returns an error, never crashes\"\ncontract\n[…]\namples/password-login/`, added in a sibling PR. Merge that first or\ntogether, or those two links 404 until it lands.\n\n---------\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: refuse mutations on read-only buffers and arenas instead of faul…",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-19T20:07:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "750f8dfadf1070a5ec053126d4a670eade84eea6",
          "body": "## Summary\n\nAdds an `examples/` module with two runnable, end-to-end programs and\nwires it into CI.\n\n- **`password-login`** — a register/login flow demonstrating the\nwipe-after-use and constant-time-comparison idioms (`SecureWipe`,\n`NewEmptyBuffer`, `Argon2DeriveInto`, `ConstantTimeEqual`) in ~150\nl\n[…]\nhe kernel-invisible path\nwas actually exercised.\n- Cross-compiles darwin/arm64 + linux/arm64; `password-login` runs on\nWindows.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "feat: add runnable examples (password-login, hardened-ssh-agent) (#34)",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-19T20:05:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f0d4e229e8e2f1ccacddb82ba3950116dfff0a3e",
          "body": "Adds the conventional CI/build-status badge, between the existing Go\nReference and Go Report Card badges:\n\n```\n[![CI](https://github.com/deadpoets/secmem/actions/workflows/ci.yml/badge.svg)](https://github.com/deadpoets/secmem/actions/workflows/ci.yml)\n```\n\nRenders the green \"CI passing\" pill from the Actions workflow on main.\nREADME-only.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "docs: add a CI status badge to the README (#33)",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-19T13:35:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7b6fb74f6b9bc8cb0a7719bc2f7f3884b16bfae1",
          "body": "Post-public cleanup. The `GOPRIVATE` env and the job-token git auth\n(`insteadOf`) existed only so CI could read the **private** secmem\nmodule's `go.mod`. Now that the repo is public, the modules resolve\nthrough the public proxy and `sum.golang.org` exactly like a downstream\nconsumer's would — so rem\n[…]\nxy/sumdb.\n\nNo library or test change — CI plumbing only. This PR's own run is the\nproof the public proxy path works end-to-end.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: drop the private-fetch scaffolding now that the repo is public (#31)",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-18T15:36:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f7f74653963f80f8ae5276524f9604b1f9c806fa",
          "body": "…retmem live) (#30)\n\nFull v0.1.0 gauntlet **PASS** on a genuinely different arm64 target — a\nLibre Computer Renegade (Rockchip **RK3328**, 4× **Cortex-A53**) on\nArmbian, kernel **6.18.35**, `CONFIG_SECRETMEM=y`.\n\n**Result:** both modules under `-race`, `GOEXPERIMENT=runtimesecret`,\nthe no-heap-escap\n[…]\nfrom the pre-public polish (#29) so that one stays as-reviewed;\nthe two touch different parts of KERNELS.md and rebase cleanly.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "docs: add the in-order Cortex-A53 arm64 row (RK3328, kernel 6.18, sec…",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-18T04:24:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "167b4749ee025dd360769ce157193139dcc0b5a5",
          "body": "… internal-ref scrub (#29)\n\nOutput of a final pre-public documentation vet: an 8-dimension\nmulti-agent audit of the whole tracked tree, every finding adversarially\nre-verified against real committed content. **Zero blockers** — no\n`galathine` leak, no secret, no security overclaim, no competitor sha\n[…]\ngolangci-lint (0 issues), actionlint, gitleaks. No library behavior\nchanges — docs and comments only, plus one CHANGELOG entry.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "docs: pre-public polish — arm64 memfd accuracy, threat-model honesty,…",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-18T04:20:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "372c8b72f5781dbf1a4ed27dbf88e175049e132a",
          "body": "…on artifact) (#28)\n\n## What\n\nAdds `&& !asan` to `TestScrub_ScrubsShallowCallTree`'s build constraint,\nwith a comment explaining why.\n\n## Why\n\nRunning the v0.1.0 release-validation gauntlet on real amd64 hardware\n(Hyper-V VM, kernel `7.0.0-1009-azure`, Go 1.26.5) surfaced this as the\n**sole `-asan` \n[…]\n exercised everywhere else.\n\n## Result\n\nThe amd64 `-asan` stage now passes clean, unblocking the amd64\nKERNELS.md row (PR #27).\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "test: exclude the legacy stack-scrub proof under -asan (instrumentati…",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-17T04:08:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "047afa6f1cfd5165b348203cd80c9c5c3fb5d4a1",
          "body": "The matrix now records what shipped, per today's release:\n\n- **v0.1.0-only table** — executed against tree `06960fb` (the released\nlibrary code, crypto exactly as its tag). First row: fresh full gauntlet\non **real arm64 silicon** (OCI Ampere A1.Flex, kernel\n`6.17.0-1011-oracle`, secretmem live) — bo\n[…]\n60fb`, test-time `replace` bridge for\noffline sibling resolution (no repo credentials placed on the disposable\nbox).\n\n---------\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "docs: rebaseline KERNELS.md on the v0.1.0 release run (#27)",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-17T03:53:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2c87a1ca4f5f5e7567ad439282aec7aeb2dfd82b",
          "body": "The version-discipline half of today's supply-chain hardening (the\nsettings half — tag ruleset, Actions allowlist, Dependabot security\nupdates — is already applied repo-side):\n\n- New **apicompat** job: `gorelease` diffs each module's exported API\nagainst its latest published tag; the report lands in\n[…]\n Actions allowlist\n(all three third-party actions run here). Not added to required contexts\n(deliberate, see above).\n\n---------\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: apicompat job — gorelease each module against its latest tag (#26)",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-17T01:19:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "06960fba6993f92655775ad507589febf9e29598",
          "body": "…ge (#25)\n\nThe release-ordering follow-through now that `v0.1.0` exists:\n\n- **secmem-crypto/go.mod**: requires `github.com/deadpoets/secmem\nv0.1.0`; the development `replace => ../` bridge is gone. go.sum carries\nthe tag's hashes. Consumability proven locally with a `GOWORK=off go\nbuild` that resolv\n[…]\ngolangci-lint, secmem-lint dogfood both modules, gitleaks.\n\nTag `secmem-crypto/v0.1.0` gets cut on the merge commit.\n\n---------\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "build(secmem-crypto): require secmem v0.1.0 and drop the replace brid…",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-17T00:37:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2faf99c38c2e48d223b292627a808c2b222b24ff",
          "body": "…1.0 (#24)\n\nRelease prep for the first core tag, per the release plan's Phase-4\nchecklist:\n\n- **SECURITY.md**: adds the required audit-status disclosure — secmem\nhas not had an independent third-party security audit; what\nself-verification exists is documented in TESTING.md, and that is not an\naudit\n[…]\n(next PR, which also drops the go.mod `replace`\nbridge).\n\nDocs-only; no code change. Tag `v0.1.0` gets cut on the merge commit.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "docs: state the not-audited status and cut the changelog for core v0.…",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-17T00:16:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3403fe8a91e7d8dfca68d63d59b1a0e23bbdee48",
          "body": "## Summary\n\n\"Generate a credential directly into locked memory, never as a heap\nstring\" is squarely this library's mission, and generated-passphrase\nsupport was missing entirely.\n\nDraws from the **EFF long wordlist** (7776 words, ~12.9 bits of entropy\neach) rather than BIP-39's, for two independent \n[…]\neclared`-shadowing finding — a local var\nnamed `max`, renamed), `gitleaks`, and the `secmem-lint` dogfood all\nclean.\n\n---------\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "feat(secmem-crypto): GenerateDicewarePassphrase (#23)",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-16T04:12:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c8271c3a9370c1e723c957d2fc54c51a55d20a80",
          "body": "## Summary\n\n`kdf.go` had Argon2 (password stretching) and full HKDF\n(Extract-then-Expand), but no way to compute a plain keyed\n`HMAC-SHA256(key=secret, msg=info)` for domain-separated subkey\nderivation from an already-uniform master secret.\n\n**The gap has a real footgun.** HKDF's own Extract step is\n[…]\n.\n- Full suite, `-race`, `vet`, `staticcheck`, `golangci-lint` (0 issues),\n`gitleaks`, and the `secmem-lint` dogfood all clean.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "feat(secmem-crypto): HMACInto/HMACSHA256Into, a raw keyed-HMAC PRF (#22)",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-16T04:02:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7e8d9c806a9ca194d09e2cfbbe3296fde7d1c8c4",
          "body": "## Summary\n\n`AsSSH` covers signing over a live connection without ever exporting key\nmaterial. There was no matching path for the complementary case:\npersisting a generated key as a portable OpenSSH private-key file.\nWithout this, a caller has to borrow the raw seed via `WithSeed` and\nre-implement P\n[…]\n 5 test) — all deliberate, each annotated with\n`//nolint:secmem-lint` and a reason, matching the project's existing\nconvention.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "feat(secmem-crypto): Ed25519Signer.MarshalOpenSSHPrivateKey (#21)",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-16T01:18:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a69a7483fc4caa21a50a158a50226bd15a1633f2",
          "body": "## Summary\n\n`Secret` already redacts to `\"[REDACTED]\"` under every `fmt`/`slog`\npath. This wires the same protection into `SecureBuffer`, `SecureArena`,\nand `ArenaSlot`, which had none — printing one of them today faults\ninstead: `fmt`'s default struct printer reflects into the guarded,\nmmap'd regio\n[…]\nssues),\n`gitleaks`, and the `secmem-lint` dogfood all clean; `secmem-crypto`\nstill builds and passes against the modified core.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: redact SecureBuffer/SecureArena/ArenaSlot under fmt and slog (#20)",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-15T16:24:34Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b7b85b21d8bd3a457bc6ceddcd9249e0da8aad1e",
          "body": "## Summary\n\nIncrement 3 (opt-in `-strict` checks) plus the module README (Increment\n4's docs).\n\n### `-strict` (off by default)\nTwo heuristic, higher-noise checks behind the `-strict` flag:\n- **L1** — a locally constructed `SecureBuffer` / signer / key that is\nnever `Destroy`ed and never handed off (\n[…]\ng **`secmem-lint/v0.1.0`**. The module imports neither\nsecmem module, so it is independent of the core/crypto release ordering.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "feat: add secmem-lint -strict checks (L1, N1) and a README (#19)",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-14T22:45:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "dd3fc6851269bb295ef6cda04be0a9fc0ead3a0d",
          "body": "## Summary\n\nRuns the `secmem-lint` analyzer (added in #15, adopted in #16) in CI and\ndogfoods it over both library modules, so the borrowing-closure\ndiscipline is enforced on every push.\n\n### CI (`.github/workflows/ci.yml`)\n- **New `secmem-lint` job** — runs the analyzer's analysistest suite,\nbuilds\n[…]\nin CI (real infra cost) for marginal benefit now that the\ndedicated `secmem-lint` job enforces the analyzer. Easy to add later.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: wire secmem-lint into CI and the Makefile (#18)",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-14T21:22:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a779a754789f7982292c8844e5050fc273fdad1b",
          "body": "## Summary\n\nAdopts **`secmem-lint`** (#15) across both modules so each passes the\nanalyzer\ncleanly. Running the tool surfaced **12 borrowed-byte egresses, all in\ntest and\nexample code** — every one triaged and handled here. **No production\ncode\nchanges** (only `_test.go` / `example_test.go`).\n\n### R\n[…]\nin —\nwhich both\n> silences the warning and runs the analyzer inside the lint job — comes\nwith\n> the CI-wiring change, not here.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "test: adopt secmem-lint across both modules (#16)",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-14T21:03:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "53f4da32fe3802813b0702d2eff8874356115c82",
          "body": "…86 flake) (#17)\n\n## Summary\n\nFixes the rare `test-386-linux` flake in the guard/canary overflow\nproofs (it\nalso affects every other platform \n\n**Root cause.** The overflow proofs corrupt the canary slack by writing\na fixed\nbyte (`0x00`, one site `0xFF`), then require `Destroy`/`Release` to\nreport\n`\n[…]\n processes** (a new random\npattern\neach run). Full core suite, `staticcheck`, `golangci-lint` (0 issues),\nand\n`gitleaks` clean.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "test: make canary-overflow corruption deterministic (fix rare linux/3…",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-14T05:46:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ba7f1f13b07c517af720cbf58dba962cd3ebf392",
          "body": "## Summary\n\nAdds **`secmem-lint`** (Phase 3), a `go/analysis` analyzer that flags\nsecret\nmaterial escaping a secmem borrowing closure — the discipline the\nlibrary\ndocuments in prose and proves for its own code at run time, now\nenforceable at\n**compile time in consumer code**.\n\nThis PR is the **analy\n[…]\ncrypto`\ntrees\nalready surfaces the expected intentional test/example egresses — those\nare\nhandled in the follow-up adoption PR.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "feat: add secmem-lint, a borrowing-closure escape analyzer (#15)",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-14T05:11:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9eb7e25b9ea4a262d4d46b70cfcb056e156396a5",
          "body": "…#14)\n\n## Summary\n\nA small documentation follow-up to #13. The opt-in termination-wipe\nchange in\nthat PR removed the auto-installed `SIGTERM`/`SIGINT`/`SIGQUIT` handler\nbut left\nseveral comments — and two package-doc lines — still describing the old\nautomatic behavior. This makes the docs match the \n[…]\n `go test ./...` (both packages),\n`staticcheck`,\n`golangci-lint` (0 issues), and `gitleaks` all clean on the current main\nbase.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "docs: align emergency-wipe comments with the opt-in signal redesign (…",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-14T05:08:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "262175739a66006fd8dacc0fef7396213e16120a",
          "body": "…t fixes (#13)\n\n## Summary\n\nA pre-release security pass across both modules. It promotes the\nout-of-process\nextraction proof into the tree as a committed regression test, fixes six\nmemory-safety / residual-secret defects surfaced by an adversarial\naudit, and\nmakes the process-global signal janitor o\n[…]\ne skips one\npre-existing\nscrub test that ASan's fake stack cannot host — a tooling artifact;\nclean\nwithout `-asan`.)\n\n---------\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Pre-release security hardening: extraction proof + memory-safety audi…",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-14T03:08:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "71e7fc0f075e16a7ffae16088f27f2e4b6962451",
          "body": "…wipe proof (#12)\n\nTurns several verification claims from \"reported\" or \"argued\nstructurally\" into invariants CI enforces, and adds a claims-to-proofs\nmatrix. Prompted by a testing-methodology review against how the field\n(libsodium/BoringSSL/Go-FIPS) and the standards (NIST ACVP, FIPS 140-3\nzeroiza\n[…]\nry test file referenced in\nTESTING.md verified to exist; the pinned ML-KEM digest verified\nbyte-identical to GOROOT.\n\n---------\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Test hardening: runtimesecret CI, alloc gates, ML-KEM/GCM KATs, live-…",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-14T00:00:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1b0ab0c8f74d74996e1feb9cbc7e4d326bdb9cf3",
          "body": "## 1. Adoption-target examples\n\nTwo runnable `Example` functions at the \"plug into a stdlib/x-crypto\nconsumer\" altitude\n- `ExampleECDSASigner_tlsCertificate` — self-sign an `x509.Certificate`,\nassemble a `tls.Certificate` (what `tls.Config.Certificates` expects).\n- `ExampleAsSSH_hostKey` — wire a si\n[…]\nir\n`Output` checks, staticcheck + golangci-lint 0 issues, cross-compile\n(linux/386, linux/arm64, darwin/arm64), gitleaks clean.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "secmem-crypto: adoption examples, naming-honesty pass, PQ posture (#11)",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-13T11:47:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f9697e2ed057396861d995e72efc39a7dc87f783",
          "body": "## What\n\nPhase 2, block 3 of `secmem-crypto` — the caveated signers that round\nout the `crypto.Signer` surface, plus the SSH adapter:\n\n- **`ECDSASigner`** (P-224/P-256/P-384/P-521): raw scalar at rest in a\n`SecureBuffer`; each Sign transiently materializes a stdlib key via\n`ecdsa.ParseRawPrivateKey`\n[…]\nhared sentinel with `Key32`).\n- RSA keygen now wipes the intermediate DER even when `SecureBuffer`\nallocation fails.\n\n---------\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "secmem-crypto block 3: ECDSA and RSA signers, AsSSH (#9)",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-13T04:56:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "db76de3a62c3a5cb87d255459e9139f902385a35",
          "body": "Second block of Phase 2. Adds OpenInto/SealInto (the SM1 fix — decrypt\ndirectly into a SecureBuffer, measured 0 allocs, tamper-zeroed), Key32\n(X25519 DH, RFC 7748 vectors, low-order-point rejection), and\nMLKEM768Key (post-quantum ML-KEM-768 seed custody). Plus runnable\nexamples, fuzz targets, and be\n[…]\nonesty precision issues, now fixed. Test-coverage\nbackfill (fuzz + benchmarks) added since one review lens misfired.\n\n---------\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "secmem-crypto block 2: AEAD, X25519, ML-KEM (#8)",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-13T03:46:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "374db53f463656bb6caff56c5f9393133f11a628",
          "body": "Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.6.0\nto 6.5.0.\n<details>\n<summary>Release notes</summary>\n<p><em>Sourced from <a\nhref=\"https://github.com/actions/setup-go/releases\">actions/setup-go's\nreleases</a>.</em></p>\n<blockquote>\n<h2>v6.5.0</h2>\n<h2>What's Changed</h2>\n<h3>\n[…]\nnless you reopen the\nPR or upgrade to it yourself)\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Bump actions/setup-go from 5.6.0 to 6.5.0 (#7)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-13T03:46:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "29eacbc3cd6338967959378cc21d37fc324920ac",
          "body": "New sibling module: Ed25519 Signer (crypto.Signer/MessageSigner, seed in\nSecureBuffer, forced RFC 8032 workaround differentially fuzzed vs\nstdlib), full-surface HKDF (RFC 5869 TC1-3), validated Argon2id (RFC\n9106-aligned frozen defaults), WithSeed persistence egress, WipeScalar.\nReviewed by a 38-age\n[…]\nthe module into CI/Makefile/Dependabot\n(multi-module ./... boundary) with stable job names and a linux/386\ntripwire.\n\n---------\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Add the secmem-crypto module (Phase 2, block 1) (#6)",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-13T03:46:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b198e3bca0e0aa7fef34610b241bb9885b300dc1",
          "body": "Bumps\n[gitleaks/gitleaks-action](https://github.com/gitleaks/gitleaks-action)\nfrom 2.3.9 to 3.0.0.\n<details>\n<summary>Release notes</summary>\n<p><em>Sourced from <a\nhref=\"https://github.com/gitleaks/gitleaks-action/releases\">gitleaks/gitleaks-action's\nreleases</a>.</em></p>\n<blockquote>\n<h2>v3.0.0</\n[…]\nr />\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\nCo-authored-by: Chris <deadpoets@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Bump gitleaks/gitleaks-action from 2.3.9 to 3.0.0 (#2)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-13T03:46:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ad2622c11d25a1f71a24d682fd6d41cb6cff1f61",
          "body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1\nto 7.0.0.\n<details>\n<summary>Release notes</summary>\n<p><em>Sourced from <a\nhref=\"https://github.com/actions/checkout/releases\">actions/checkout's\nreleases</a>.</em></p>\n<blockquote>\n<h2>v7.0.0</h2>\n<h2>What's Changed</h2>\n<ul>\n[…]\nils>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\nCo-authored-by: Chris <deadpoets@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Bump actions/checkout from 4.3.1 to 7.0.0 (#3)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-13T03:46:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b30029457bd0256dc684d146b4361dae4ee48034",
          "body": "Bumps\n[golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action)\nfrom 7.0.1 to 9.3.0.\n<details>\n<summary>Release notes</summary>\n<p><em>Sourced from <a\nhref=\"https://github.com/golangci/golangci-lint-action/releases\">golangci/golangci-lint-action's\nreleases</a>.</em></p>\n<bloc\n[…]\nils>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\nCo-authored-by: Chris <deadpoets@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Bump golangci/golangci-lint-action from 7.0.1 to 9.3.0 (#4)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-13T03:46:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ea53984b7f5e941dfe8a9ab1d515c9c6cc0fb5cd",
          "body": "Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.6.0\nto 6.5.0.\n<details>\n<summary>Release notes</summary>\n<p><em>Sourced from <a\nhref=\"https://github.com/actions/setup-go/releases\">actions/setup-go's\nreleases</a>.</em></p>\n<blockquote>\n<h2>v6.5.0</h2>\n<h2>What's Changed</h2>\n<h3>\n[…]\nnless you reopen the\nPR or upgrade to it yourself)\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Bump actions/setup-go from 5.6.0 to 6.5.0 (#5)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-13T03:46:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ad8f9cbd33e6783174911666ac1fbd731b0a1e38",
          "body": "Records the suite executing on real Windows 11 hardware and Windows\nServer 2022 (CI), including guard-fault/canary/WER/seal/hardening\nproofs. Discloses Windows 10 as not yet verified.\n\n---------\n\nChris Fink <7587613+deadpoets@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Add WINDOWS.md: real-hardware verification log (#1)",
          "author_name": "Chris",
          "author_login": "deadpoets",
          "committed_at": "2026-07-13T03:46:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4d03c77d745b0650e3b6995279ea62193d043f1f",
          "body": "v6 hard-rejects any v2.x golangci-lint version string outright\n(\"golangci-lint v2 is not supported by golangci-lint-action v6\") — not a\nresolution quirk like the prior two fixes, the action itself never\nsupported it. v7 does.",
          "is_bot": false,
          "headline": "Bump golangci-lint-action to v7 for v2 config support",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-13T03:46:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6ebff07fdbd065579157ae515716fe6a1a558a26",
          "body": "golangci-lint-action's \"latest\" resolved to v1.64.8, which speaks the v1\nconfig schema — but .golangci.yml uses the v2 schema (version: \"2\",\nlinters.default, a formatters block), matching the v2.12.2 binary\ninstalled locally. The mismatch wasn't a Go-version problem as the first\nerror suggested; goi\n[…]\nlt v1.64.8 from source against\ngo1.26, and *that* binary then rejected our v2-schema config outright.\nPinning the action to the same major.minor as the local dev toolchain\nfixes both symptoms at once.",
          "is_bot": false,
          "headline": "Pin golangci-lint to v2.12.2 in CI",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-13T03:46:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3a7ce179f00e5f634efff177f7487cfe654fbf23",
          "body": "The first real run on GitHub Actions surfaced two workflow bugs:\n\n- test/test-arm64-linux ran bare \\`go vet\\`, which doesn't see\n  .golangci.yml's documented exclusions for the known-safe unsafe.Pointer\n  cases (OS-owned addresses, guard-page/dead-stack proof tests) — so it\n  failed on exactly the f\n[…]\n pulled a prebuilt golangci-lint binary built with go1.24,\n  which can't parse this module's go 1.26 directive. install-mode:\n  goinstall builds it from source against the job's own toolchain instead.",
          "is_bot": false,
          "headline": "Fix CI: drop redundant go vet, build golangci-lint from source",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-13T03:46:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bc9111b5df478ee18502eb55ce6f8cf101b86d71",
          "body": "Wires up what branch protection will enforce: CODEOWNERS makes @deadpoets\nreview mandatory on every PR (including the maintainer's own, once\nprotection applies to admins too). CONTRIBUTING.md documents the workflow,\nlocal check commands, and the commit-signing requirement. SECURITY.md\nroutes vulnera\n[…]\novenant\n2.1. Issue templates split bug reports from feature requests and redirect\nsecurity reports and usage questions away from the tracker; the PR\ntemplate checklist mirrors what CI actually checks.",
          "is_bot": false,
          "headline": "Add repo governance: CODEOWNERS, CONTRIBUTING, CoC, SECURITY, templates",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-13T03:46:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d7c2e56c6cbcc177325e4170b42c97ce9612fa49",
          "body": "Matrix: go vet + race tests on linux/macos/windows amd64, plus a native\nlinux/arm64 runner. Separate cross-compile job builds and test-compiles\nfor darwin/arm64, darwin/amd64, windows/arm64, and linux/arm64 to catch\nplatform-specific compile errors even where a native runner isn't\navailable. Also wires golangci-lint, staticcheck, govulncheck, and a\ngitleaks secret scan into CI so the pre-push checks run on every push\nand PR, not just locally.",
          "is_bot": false,
          "headline": "Add GitHub Actions CI",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-13T03:46:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bf9c777983c0b4dd0ccdce8fb27806b8f39296dc",
          "body": "Runs the full suite on real aarch64 silicon (Oracle Cloud Ampere A1.Flex)\nacross four kernels/distros, replacing the README's \"not yet run on real\narm64 hardware\" hedge with confirmed coverage across amd64+arm64,\nkernels 5.10 through 7.x.\n\nAdds ENVIRONMENTS.md documenting measured behavior across ro\n[…]\nce\nthat kernel version alone doesn't determine the L4 isolation path.\n\nAdds environment_test.go (TestReportEnvironment) as a standalone,\nno-code-required way to check Probe() output on any given host.",
          "is_bot": false,
          "headline": "Close the arm64 real-hardware coverage gap",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-13T03:46:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "acf902029aa11b69b1385e837ce9ece689d3c9dd",
          "body": "TestMlockFailure_ReturnsErrorNotPanic set RLIMIT_MEMLOCK=0 and expected\nallocation to fail, but CAP_IPC_LOCK bypasses RLIMIT_MEMLOCK entirely, so\nthe test passed for the wrong reason (or not at all) under root and any\ncontainer runtime that grants the capability by default. The re-exec'd\nchild now drops CAP_IPC_LOCK before setting the rlimit, pinned to one OS\nthread; if the drop itself fails, the child reports inconclusive rather\nthan a false pass or panic.",
          "is_bot": false,
          "headline": "Fix negative mlock test to be valid under CAP_IPC_LOCK",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-13T03:46:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2ef617a91cb61a84cb61c8ddb59917dce2fcc1c8",
          "body": "The reader-facing capstone, all of it verifiable or falsifiable.\n\nRunnable Example tests for both packages — the core lifecycle, Scope,\nSecret redaction, Probe, SecureArena, the Sanitizer, provider rules,\nand the slog Handler. They compile, run under go test, and render on\npkg.go.dev, so a doc that \n[…]\n path,\nsame syscall number) while disclosing that only amd64 has been executed\nso far, with KERNELS.md as the authoritative record. CHANGELOG.md\nfollows keep-a-changelog with the 0.x stability caveat.",
          "is_bot": false,
          "headline": "Add the docs: guarantee matrix, threat model, examples, changelog",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-13T03:46:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4700045b336cbfba164497b14e1104a599e92b56",
          "body": "The guard-page rewrite dropped the architecture check on\nallocMemfdSecret. sysMemfdSecret (447) is the asm-generic syscall\nnumber and is correct only on 64-bit arches (amd64, arm64, riscv64); on\n32-bit linux that number is a different syscall entirely, so calling it\nunconditionally was wrong — at be\n[…]\nre the rewrite. On 64-bit\nthe check folds to a constant and the memfd path is unchanged (still\nverified against /proc/self/mem on amd64). All five linux arches\n(386, arm, amd64, arm64, riscv64) build.",
          "is_bot": false,
          "headline": "Restore the 64-bit guard on the memfd_secret path",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-13T03:46:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4ade3dac1ddd1ff2ef311a2c6f01a2d0c558e966",
          "body": ".golangci.yml enables a curated linter set on top of the standard ones\n(govet, staticcheck, errcheck, ineffassign, unused): gosec — on-brand\nfor a security library — plus bodyclose, misspell, unconvert, unparam,\nnilerr, errorlint, copyloopvar, predeclared, and gofmt -s. The set is\ndeliberately not m\n[…]\nied with\ngolangci-lint and staticcheck across native, linux, darwin, windows,\nthe stub platform, and the runtimesecret path; govulncheck clean; go\nmod tidy/verify leave the x/sys-only graph unchanged.",
          "is_bot": false,
          "headline": "Add the in-repo lint configuration",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-13T03:46:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "108222ba9acf880c160eed40a8c1a0246d95375e",
          "body": "The failure-mode promises are as load-bearing as the features, so they\nget proofs of their own.\n\nConstructors never panic on bad input — nil, empty, negative, and\noverflow sizes all return errors. Every buffer, arena, slot, and secret\nmethod is exercised on a nil receiver and after Destroy/Seal and \n[…]\n no surviving\ncontrol char, never panics) hold under fuzzing. The sanitizer fuzz\ntarget is what surfaced the truncation-idempotence bug fixed in the\nprior commit; its regression input ships as a seed.",
          "is_bot": false,
          "headline": "Add the adversarial negative suite",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-13T03:45:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fb64f47b4f48749186475666ada51d9c0da16d0f",
          "body": "Sanitize applied its rules once and truncated last. The truncation\nmarker \"[REDACTED:truncated]\" introduces a word boundary the original\ntext did not have, so a rule could match on a second pass what it could\nnot on the first — a hex run longer than maxLen, broken past the cut by\na non-hex word char\n[…]\nsee text a caller already sanitized.\nConvergence is 1-3 passes (tags never re-match a rule); the pass count\nis bounded only as a guard. A named regression test pins the exact\ntruncation-boundary case.",
          "is_bot": false,
          "headline": "Make the sanitizer idempotent under truncation",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-12T18:00:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "279407c11601278b597968b9dff927289cb55c97",
          "body": "redact is the boundary-level complement to Secret: where Secret makes a\nheld value self-redacting, redact scrubs free-form text that has already\nbeen assembled — a log line, an error string — masking credential-shaped\nsubstrings and neutralizing CWE-117 log injection (CRLF, ANSI, shell\nmetacharacter\n[…]\nrget.\nTests drive the real sinks: a live slog text logger for message, string,\nerror, grouped, WithAttrs, and LogValuer paths, plus idempotence,\ntruncation, and the provider-rules-are-opt-in contract.",
          "is_bot": false,
          "headline": "Add the redact subpackage for boundary-level log scrubbing",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-12T18:00:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4619347306fae97741a4f38882b6e7bd48a1f70c",
          "body": "HardenProcess was Linux-only, returning HardenNone everywhere else, and\nDESIGN's DisableCoreDumps / SetMemlockLimit helpers were unimplemented.\nThis lands all three across the platforms that have the primitives.\n\nHardenProcess on Windows now applies two irreversible mitigation\npolicies via SetProces\n[…]\n tested out-of-process in re-exec'd children so they don't poison the\nparallel suite; SetMemlockLimit's never-lower contract is tested\nin-process. Verified on Windows natively and on Linux under WSL2.",
          "is_bot": false,
          "headline": "Make process hardening cross-platform; add the rlimit helpers",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-12T18:00:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9de39782b13dfead38e4e35c146f4631a851d537",
          "body": "While sealed, pages are PAGE_NOACCESS — in-process reads already\nfault. What page protection cannot stop is a full process memory dump:\nprocdump, Task Manager, WER full dumps, and the hibernation file read\nthrough the kernel and ignore protection bits, so a dormant sealed\nsecret appeared in every du\n[…]\ned buffer\nmust not false-report a canary violation, and a real overflow\ninflicted before sealing must still be detected after a full cipher\ncycle — the cipher raises the dump bar without masking bugs.",
          "is_bot": false,
          "headline": "Encrypt sealed buffers with a kernel-held key on Windows",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-12T18:00:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "27581e93a8a36df52380eef3c93bd7a7fe3ad6d6",
          "body": "Two Linux features can duplicate secret bytes onto physical frames\noutside our wipe's reach, and both are one madvise away from off:\n\nkhugepaged collapses anonymous pages into a transparent hugepage by\nCOPYING them to new frames and freeing the originals unwiped — a\nkernel-made copy of the secret th\n[…]\n threat being disabled does\nnot exist. The proof test does not trust the return code — it reads\n/proc/self/smaps and requires the kernel's own \"nh\" VmFlag on the\nsecret VMA (verified live under WSL2).",
          "is_bot": false,
          "headline": "Deny the kernel's page-copying optimizations on secret memory",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-12T18:00:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7c3e152f86af78e0576c4b38a6e765752d5f7418",
          "body": "secmem's most security-critical path — memfd_secret mapped MAP_FIXED\ninto a pre-reserved PROT_NONE range — depends on kernel behavior with\nno stability promise beyond the syscall. KERNELS.md records every\nkernel the suite has actually been EXECUTED on, with the three security\nproofs (guard-fault, me\n[…]\n WSL2 kernel,\nsecretmem live, full pass) and 6.18.26 (stock WSL2, secretmem live,\nfull pass). The reproduction recipe is a single self-contained test\nbinary — the target machine needs no Go toolchain.",
          "is_bot": false,
          "headline": "Start the kernel verification log",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-12T18:00:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5b2463ffd5c4acd3b8987aae153c79b61aedd52c",
          "body": "Each allocation is now [ guard | secret pages | guard ]: PROT_NONE\nreservations on Linux/Darwin, reserved-uncommitted memory on Windows. A\nlinear over/under-flow that reaches a guard faults instead of silently\ntouching whatever the kernel placed next to the secret. The page-\nrounding slack behind th\n[…]\nallback, which has no address space to bracket. The\nwhole suite is race-clean (first -race run of this project) and the\nfull Linux suite, including the live memfd_secret path, passes on a\nreal kernel.",
          "is_bot": false,
          "headline": "Bracket every secret with guard pages and canaries",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-12T18:00:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "89ad50baa7aab468c3aae6965229f5ece07dc331",
          "body": "Secret wraps a SecureBuffer as a value safe to embed in structs that\nget logged, formatted, or marshalled. The redaction methods are\nimplemented, not omitted — fmt and encoding/json reflect into struct\nfields, so a type without String/GoString/MarshalText/MarshalJSON/\nLogValue leaks the moment someo\n[…]\nstill works, nothing panics. Tests drive the\nreal sinks — fmt verbs on values, pointers, and struct fields,\njson.Marshal, and a live slog logger — asserting the plaintext never\nappears in any of them.",
          "is_bot": false,
          "headline": "Add Secret, the leak-safe value type",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-12T18:00:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "34e93c355ef4a21d31346e4c46f2ab5a56518863",
          "body": "The package docs promise that a platform with no lockable off-heap\nmemory \"fails loudly rather than degrading to unprotected heap\nstorage.\" Until now that was a lie: the stub silently make([]byte)'d\nand returned nil — the exact footgun this library is positioned\nagainst. Now it is true.\n\nConstructor\n[…]\nlatform; each mlock_*.go declares its platformHasSecureMemory const.\nThe stub-tagged tests pin fail-closed and opt-in behavior; they compile\nunder GOOS=freebsd vet but need a stub platform to execute.",
          "is_bot": false,
          "headline": "Fail closed on platforms without secure memory",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-12T18:00:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "21c7df8a51ac8c36c16a1761c37a0a786b1d4d57",
          "body": "The package docs promise \"use Probe at startup\" and per-buffer\nCapabilities; this commit makes both true, per DESIGN §6.\n\nThe allocators stop swallowing what they did. allocSecretMem and\nallocMapAnon on all four platforms now return an allocInfo recording\nwhich protections the allocation actually re\n[…]\nfrom a per-arch archWipeGuaranteed const (asm +\ncache flush on amd64/arm64, constant-time store elsewhere);\nRegisterScrub from RuntimeSecretActive(); GuardPages is always false\nuntil guard pages land.",
          "is_bot": false,
          "headline": "Add honest capability reporting: Capabilities, Probe, Warnings",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-12T18:00:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "87b98ea4a51d7ec5545322331327bbaf40f5ec96",
          "body": "Same lens as the Scrub rename, applied to the rest of the surface.\n\nSecureBuffer.Read/Write become CopyOut/CopyIn. They borrowed the two\nmost loaded names in Go's I/O vocabulary while honoring neither\ncontract: not Reader/Writer (wrong shape), not ReaderAt/WriterAt\n(partial copies, never a short-rea\n[…]\nstructors, the Harden bitmask, the buffer and\narena verbs, the runtime/secret posture family, and the ErrDestroyed /\nErrArenaDestroyed asymmetry (the unprefixed one is the package's\ngeneral sentinel).",
          "is_bot": false,
          "headline": "Rename for honesty: copies, comparisons, slots, frame files",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-12T18:00:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8ea1ccf573002e3f562b782b510ce3d27b18f2b0",
          "body": "WipeBytes and WipeArray had no callers — not in the library, not in the\ntests beyond their own. WipeArray took a slice, not an array, so the\nname was factually wrong, and its whole body was WipeBytes(b). Worse,\nboth lived in the legacy file set, so the public API changed shape by\nbuild: present on W\n[…]\n positioned it as canonical.\nThe orphaned wipeBytes assembly and its constant-time generic twin go\nwith the exports; the only thing left in the legacy files is the 32 KiB\nframe wipe that Scrub defers.",
          "is_bot": false,
          "headline": "Delete the redundant exported wipes",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-12T18:00:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "19e6f643b91667773ddc5f92454e26f81fee50bb",
          "body": "SecretDo named the implementation, not the abstraction — and the\nimplementation it named (runtime/secret.Do) is absent on every platform\nbut linux/amd64|arm64, exactly where the best-effort fallback matters\nmost. It also shared a prefix with the Secret value type while having\nnothing to do with it, \n[…]\n the scrub name.\nThe runtime/secret experiment surface (RuntimeSecretActive,\nAssertRuntimeSecret, ErrRuntimeSecretInactive) keeps its name, since it\ndescribes the experiment posture, not the function.",
          "is_bot": false,
          "headline": "Rename SecretDo to Scrub",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-12T18:00:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f0699cd688840ce0042c7317c61d988a4bc25b1b",
          "body": "The 32 KiB frame wipe SecretDo defers on the legacy path allocates its\nown stack frame to zero. On a shallow call tree that allocation triggers\nmorestack: the goroutine's stack is copied to a larger segment, so the\nsingle deferred wipe ran on the RELOCATED stack — zeroing the fresh copy\nwhile fn's r\n[…]\n a uintptr held across calls — the only way to observe\nresidual stack in Go — drawing a documented vet unsafeptr report on\nlegacy-amd64, suppressed inline now and via .golangci.yml at the lint commit.",
          "is_bot": false,
          "headline": "Fix the legacy frame scrub's shallow-stack miss",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-12T18:00:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5bc9aacceed3862f00f3e4905440bf2fcd09864b",
          "body": "WithBytesHardened, WithBytesHardenedErr, SecureContext, PanicError, and\nthe 2 KiB scratch-frame wipe had no callers — not in the library, not in\nthe consumers, not in the design. The June security amendments replaced\nthe cluster with SecretDo and wired all the production secret paths to\nthat; this w\n[…]\nability hole of its own — it silently misses when the goroutine\nstack is shallow — which the next commit fixes; the 2 KiB variant\ndeleted here was not the fix, just a smaller wipe welded to dead code.",
          "is_bot": false,
          "headline": "Delete the dead legacy-hardened wrapper cluster",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-12T18:00:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "babe26e7b4d7f1b7ac6013b39f38364ae2c64510",
          "body": "The borrowing accessors called fn without checking it, so a nil callback\npanicked inside library frames — which the no-panic rule forbids. Guard\nthe eight of them (WithBytes/WithBytesErr on both the buffer and the\narena slot, Scope, ScopeWith, and the two hardened wrappers): a nil fn\nnow comes back \n[…]\n receiver already does.\nScopeWith checks its ctor too.\n\nThe scrub primitives (SecretDo, SecureContext) have the same hole. They,\nand whether SecureContext should be exported at all, are the next pass.",
          "is_bot": false,
          "headline": "Return an error, not a panic, on a nil callback",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-12T18:00:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8d0a891e9bf81fe37cde6ccbc41c2eabbd3c9fde",
          "body": "Wrong shape and wrong name. It borrowed the With* prefix from the byte\naccessors, but those give you a view that dies with the closure — this\ngives you a heap copy you're meant to keep. It was also a free function\nwhere every other accessor is a method, took a purpose label nobody ever\npassed, and n\n[…]\n on runtimesecret builds the GC erases\nit once nothing references it — best effort, not a promise. Tests pin\nthe load-bearing part: the returned string still reads right after the\nbuffer is destroyed.",
          "is_bot": false,
          "headline": "Replace UseAsString with ExposeString",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-12T18:00:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4a60c62ef4b69c533f4ead232cae0f287bf4f388",
          "body": "Rename the package from security to secmem everywhere the old name\nleaked: log and error messages, doc-comment examples, per-file headers.\nGive the error sentinels a secmem: prefix, and drop the two keyring\nsentinels that rode along in errors.go — they belong to code that\ndidn't come with us.\n\nColla\n[…]\nverview instead of nine, and rewrite the leftover internal references\n(a predecessor type name, review tags, a roadmap phase) into prose that\nstands on its own.\n\nRename and docs only, no logic change.",
          "is_bot": false,
          "headline": "Scrub the internal branding and tidy the docs",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-12T18:00:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a268776477ab358046afdff9e4892a5df4e72dbf",
          "body": "The off-heap buffer and everything it can't compile without:\nSecureBuffer, the arena, the buffer lock, the wipe asm, the\nmlock/VirtualLock allocators, process hardening, the runtime/secret\nscrub (with the legacy frame-scrub fallback for platforms that lack it),\nand the crash-wipe registry. Tests com\n[…]\nmap'd pages, locked out of swap, wiped on destroy, and\nyou only touch them inside a closure. No raw-slice accessor.\n\nOnly dependency is x/sys. Builds on linux/darwin/windows x amd64/arm64,\ntests pass.",
          "is_bot": false,
          "headline": "Bring in the SecureBuffer core",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-12T18:00:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "cfd374fb6dae536f9e79628719899d90dfc05a3d",
          "body": "Stand up the repository skeleton for the pure-Go secmem library:\n\n- go.mod: module github.com/deadpoets/secmem, go 1.26 (no requires yet;\n  x/sys is added with the first code that imports it)\n- LICENSE: Apache-2.0\n- doc.go: package overview and lifecycle\n- Repo hygiene: .gitattributes (LF normalization), .editorconfig,\n  .gitignore, and a Makefile (test/fmt/vet/lint/vuln/fuzz/cover/tidy)",
          "is_bot": false,
          "headline": "Scaffold the secmem core module",
          "author_name": "Chris Fink",
          "author_login": "deadpoets",
          "committed_at": "2026-07-12T18:00:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 2,
      "commits_last_year": 69,
      "latest_release_at": "2026-07-20T00:43:23Z",
      "latest_release_tag": "v0.2.0",
      "releases_from_tags": true,
      "days_since_last_push": 2,
      "active_weeks_last_year": 2,
      "days_since_latest_release": 3,
      "mean_days_between_releases": 3
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 100,
      "has_issue_template": false,
      "has_code_of_conduct": true,
      "has_pull_request_template": true
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/deadpoets/secmem",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/deadpoets/secmem",
          "is_deprecated": false,
          "latest_version": "v0.2.0",
          "repository_url": "https://github.com/deadpoets/secmem",
          "versions_count": 2,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-20T00:43:23Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 3
        },
        {
          "name": "github.com/deadpoets/secmem/secmem-lint",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/deadpoets/secmem/secmem-lint",
          "is_deprecated": false,
          "latest_version": "v0.1.0",
          "repository_url": "https://github.com/deadpoets/secmem",
          "versions_count": 1,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-14T22:45:04Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 8
        },
        {
          "name": "github.com/deadpoets/secmem/secmem-crypto",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/deadpoets/secmem/secmem-crypto",
          "is_deprecated": false,
          "latest_version": "v0.2.0",
          "repository_url": "https://github.com/deadpoets/secmem",
          "versions_count": 2,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-21T00:56:08Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 2
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 1,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": null,
      "open_issues_and_prs": 1
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "examples/go.mod",
        "go.mod",
        "secmem-crypto/go.mod",
        "secmem-lint/go.mod"
      ],
      "largest_source_bytes": 22634,
      "source_files_sampled": 148,
      "oversized_source_files": 0,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "examples/go.mod",
        "go.mod",
        "secmem-crypto/go.mod",
        "secmem-lint/go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "golang.org/x/crypto",
            "direct": true,
            "version": "v0.54.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5932"
            ],
            "fixed_version": null,
            "advisory_count": 1,
            "oldest_advisory_days": 15
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "unknown": 1
        },
        "advisory_count": 1,
        "affected_count": 1,
        "assessed_count": 7,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 1
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "golang.org/x/sys",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.47.0"
        },
        {
          "name": "filippo.io/edwards25519",
          "manifest": "secmem-crypto/go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.0"
        },
        {
          "name": "github.com/deadpoets/secmem",
          "manifest": "secmem-crypto/go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.2.0"
        },
        {
          "name": "golang.org/x/crypto",
          "manifest": "secmem-crypto/go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.54.0"
        },
        {
          "name": "golang.org/x/tools",
          "manifest": "secmem-lint/go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.48.0"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "filippo.io/edwards25519",
            "direct": true,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/deadpoets/secmem",
            "direct": true,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/crypto",
            "direct": true,
            "version": "v0.54.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": true,
            "version": "v0.47.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/tools",
            "direct": true,
            "version": "v0.48.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/mod",
            "direct": false,
            "version": "v0.38.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sync",
            "direct": false,
            "version": "v0.22.0",
            "ecosystem": "go"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 7,
        "direct_count": 5,
        "indirect_count": 2
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 38,
        "open_issues": 1,
        "closed_ratio": 0,
        "closed_issues": 0,
        "closed_unmerged_prs": 1
      },
      "bus_factor": 1,
      "bot_contributors": 1,
      "top_contributors": [
        {
          "type": "User",
          "login": "deadpoets",
          "commits": 63,
          "avatar_url": "https://avatars.githubusercontent.com/u/7587613?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "fuzz.yml"
      ],
      "has_docs_dir": false,
      "linter_configs": [
        ".golangci.yml"
      ],
      "has_editorconfig": true,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 8,
            "reason": "branch protection is not maximal on development and all release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/29 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 0,
            "reason": "project has 0 contributing companies or organizations -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 10,
            "reason": "project is fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 8,
            "reason": "dependency not pinned by hash detected -- score normalized to 8",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 10,
            "reason": "GitHub workflow tokens follow principle of least privilege",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 9,
            "reason": "1 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "f006acc0001ce27ba6b1462d66510595b962f5f8",
        "ran_at": "2026-07-23T08:23:31Z",
        "aggregate_score": 6.9,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": true,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-23T08:17:06Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": "2026-07-21T00:56:08Z",
      "ci_last_conclusion": "FAILURE",
      "oldest_open_issues": [
        {
          "number": 32,
          "created_at": "2026-07-18T16:01:30Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/deadpoets/secmem",
    "host": "github.com",
    "name": "secmem",
    "owner": "deadpoets"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 59,
      "inputs": {
        "security": 74,
        "vitality": 68,
        "community": 43,
        "governance": 41,
        "engineering": 74
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "moderate",
        "name": "Vitality",
        "value": 68,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 54,
            "inputs": {
              "commits_last_year": 69,
              "human_commit_share": 0.913,
              "days_since_last_push": 2,
              "active_weeks_last_year": 2
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 2 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 2
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "2/52 weeks with commits",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 2
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "69 commits in the last year",
                "points": 16.6,
                "status": "partial",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 69
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 88,
            "inputs": {
              "releases_count": 2,
              "latest_release_tag": "v0.2.0",
              "releases_from_tags": true,
              "days_since_latest_release": 3,
              "mean_days_between_releases": 3
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "2 version tags (no GitHub releases)",
                "points": 16.2,
                "status": "partial",
                "details": [
                  {
                    "code": "version_tags_no_releases",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 3 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 3
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~3 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 3
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 43,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 1,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "1 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "excellent",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 92,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": true,
              "has_pull_request_template": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 13.5,
                "status": "met",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 6.3,
                "status": "met",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 41,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "at_risk",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 37,
            "inputs": {
              "merged_prs": 38,
              "open_issues": 1,
              "closed_issues": 0,
              "issue_closed_ratio": 0,
              "closed_unmerged_prs": 1
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "0% of issues closed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 0
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "38/39 decided PRs merged",
                "points": 37.3,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 38,
                      "decided": 39
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/29 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 42,
            "inputs": {
              "followers": 1,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "deadpoets",
              "public_repos": 20,
              "account_age_days": 4452
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "1 followers of deadpoets",
                "points": 2.2,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 1,
                      "login": "deadpoets"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "20 public repos, account ~12 yr old",
                "points": 21.6,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 20
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 12
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 92,
            "inputs": {
              "packages": [
                "github.com/deadpoets/secmem",
                "github.com/deadpoets/secmem/secmem-lint",
                "github.com/deadpoets/secmem/secmem-crypto"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 2
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "3 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 3,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 2 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 2
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "2 published versions",
                "points": 12,
                "status": "partial",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 74,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "excellent",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": true,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "2 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 6.4,
                "status": "met",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "moderate",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "topics": [
                "cryptography",
                "go",
                "golang",
                "hardening",
                "key-management",
                "memory-safety",
                "mlock",
                "secret-management",
                "secrets",
                "secure-memory",
                "security",
                "memfd-secret"
              ],
              "has_wiki": false,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": false,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "12 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 12
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "good",
        "name": "Security",
        "value": 74,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "good",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Packaging, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "packaging",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 70,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 16,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 2,
              "scorecard_aggregate": 6.9
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection is not maximal on development and all release branches",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/29 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is fuzzed",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 8",
                "points": 4,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "GitHub workflow tokens follow principle of least privilege",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "1 existing vulnerabilities detected",
                "points": 6.8,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories. Remaining weights renormalized. Matched 7 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 7
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 89,
            "inputs": {
              "source": "osv",
              "advisories": 1,
              "affected_packages": 1,
              "assessed_packages": 7,
              "unassessed_packages": 0,
              "affected_by_severity": "unknown 1",
              "direct_affected_packages": 1
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "1 affected: golang.org/x/crypto v0.54.0 (unknown)",
                "points": 26.6,
                "status": "partial",
                "details": [
                  {
                    "code": "advisories_affected",
                    "params": {
                      "count": 1,
                      "packages": "golang.org/x/crypto v0.54.0 (unknown)"
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory has been public longer than 90 days",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "advisories_none_stale",
                    "params": {
                      "days": 90
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 7,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 2
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 68,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "63 of 63 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 63,
                      "sampled": 63
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "excellent",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 88,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum"
              ],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "examples/go.mod",
                "go.mod",
                "secmem-crypto/go.mod",
                "secmem-lint/go.mod"
              ],
              "dependency_bot_commit_share": 0.087
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 69",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 69
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "6 of the last 69 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 6,
                      "sampled": 69
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 8",
                "points": 8,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 22634,
              "source_files_sampled": 148,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/148 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 148,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "at_risk",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-23T08:23:45.399020Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/d/deadpoets/secmem.svg",
  "full_name": "deadpoets/secmem",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}