公开记录中等
软件健康报告模式 0.27.0 · 指标 1.13.0 · 2026-07-23 08:23 UTC
deadpoets / secmem
Pure-Go off-heap secret memory: mmap/mlock, memfd_secret L4 isolation, guard pages, fail-closed by default
deadpoets/secmem 的健康指数为 100 分中的 59 分，处于「中等」区间。 其得分最高的类别是Engineering Quality（74/100），最低的是Sustainability & Governance（41/100）。 最近一次更新在 2 天前。 近期的大部分工作由 1 位贡献者完成。
59
总分 / 100软件健康指数
指标归入加权类别，统一采用 1–100 量表。总体分先取类别加权平均；当公开证据触发高风险司法辖区政策时，评级会按政策调整，并设置 49（有风险）的上限。AI 就绪度不计入总体分。
59
优秀85-100堪称典范；基本满足所有检验标准
良好70-84健康；仅有轻微不足
中等50-69可接受，但存在明显不足；建议进行审查
存在风险30-49存在重大薄弱环节；采用时应保持审慎
危急1-29问题严重（项目被弃置、仅有单一维护者、缺乏基本工程规范）
评分画像
每条轴代表一个类别。形状比平均值更重要——健康的对象会填满整个图形，而“一峰一谷”式画像意味着某一维度的优势正掩盖另一维度的风险。
所有权
软件包生态系统
| 注册表 | 软件包 | 版本 | 月下载量 | 版本数 | 最近发布 |
|---|---|---|---|---|---|
| Go | github.com/deadpoets/secmem | v0.2.0 | - | 2 | 3 天前 |
| Go | github.com/deadpoets/secmem/secmem-lint | v0.1.0 | - | 1 | 8 天前 |
| Go | github.com/deadpoets/secmem/secmem-crypto | v0.2.0 | - | 2 | 2 天前 |
按类别列示的指标
活力
项目是否仍有生命——是否仍在编写代码，是否仍在发布版本？
68
开发活跃度
54中等
评分方式
| 36/36 | 推送新近度 — 最近一次推送于 2 天前 |
| 1.4/36 | 提交节奏 — 52 周中有 2 周有提交 |
| 16.6/18 | 提交量 — 最近一年 69 次提交 |
| 0/10 | OpenSSF Scorecard：Maintained — project was created within the last 90 days. Please review its contents carefully |
所用输入
| commits_last_year | 69 |
| human_commit_share | 0.913 |
| days_since_last_push | 2 |
| active_weeks_last_year | 2 |
发布纪律
88优秀
评分方式
| 16.2/27 | 有发布版本 — 2 个版本标签（无 GitHub 发布版本） |
| 36/36 | 发布时效 — 最近一次发布版本于 3 天前 |
| 27/27 | 发布节奏 — 约每 3 天发布一次 |
| 0/10 | OpenSSF Scorecard：Signed-Releases — 无数据 |
所用输入
| releases_count | 2 |
| latest_release_tag | v0.2.0 |
| releases_from_tags | 是 |
| days_since_latest_release | 3 |
| mean_days_between_releases | 3 |
已排除计分（无数据或不适用）：OpenSSF Scorecard：Signed-Releases。 其余权重已重新归一化。
社区与采用
项目是否拥有用户、下载量与关注度，并具备欢迎贡献者参与的配置？
43
流行度与采用
1危急
评分方式
| 0/60 | 星标 — 1 个星标 |
| 0/25 | 复刻 — 0 个复刻 |
| 0/15 | 关注者 — 0 位关注者 |
所用输入
| forks | 0 |
| stars | 1 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
社区健康
92优秀
评分方式
| 22.5/22.5 | README |
| 22.5/22.5 | 许可证 — 可识别的许可证（Apache-2.0） |
| 18/18 | CONTRIBUTING 指南 |
| 13.5/13.5 | 行为准则 |
| 0/7.2 | 议题模板 |
| 6.3/6.3 | PR 模板 |
所用输入
| has_readme | 是 |
| has_license | 是 |
| has_contributing | 是 |
| has_issue_template | 否 |
| has_code_of_conduct | 是 |
| has_pull_request_template | 是 |
可持续性与治理
项目能否在其成员之外延续——巴士系数、响应能力、由谁支持，以及软件包的维护状况？
41
维护者韧性（巴士系数）
10危急
评分方式
| 9/54 | 巴士系数 — 1 位贡献者贡献了半数提交 |
| 0/22.5 | 提交分布 — 头号贡献者编写了 100% 的提交 |
| 1.4/13.5 | 贡献者广度 — 1 位贡献者 |
| 0/10 | OpenSSF Scorecard：Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
所用输入
| bus_factor | 1 |
| contributors_sampled | 1 |
| top_contributor_share | 1 |
议题与 PR 响应能力
37存在风险
评分方式
| 0/46.8 | 议题解决 — 0% 的议题已关闭 |
| 37.3/38.3 | PR 接受 — 已裁定的 PR 中 38/39 已合并 |
| 0/15 | OpenSSF Scorecard：Code-Review — Found 0/29 approved changesets -- score normalized to 0 |
所用输入
| merged_prs | 38 |
| open_issues | 1 |
| closed_issues | 0 |
| issue_closed_ratio | 0 |
| closed_unmerged_prs | 1 |
所有权与托管责任
42存在风险
评分方式
| 10/30 | 所有权背书 — 个人（用户）账户 |
| 0/20 | 已验证域名 — 不适用于个人账户 |
| 2.2/25 | 所有者影响力 — deadpoets 有 1 位关注者 |
| 21.6/25 | 既往记录 — 20 个公开仓库，账户约 12 年 |
所用输入
| followers | 1 |
| owner_type | User |
| is_verified | — |
| owner_login | deadpoets |
| public_repos | 20 |
| account_age_days | 4,452 |
已排除计分（无数据或不适用）：已验证域名。 其余权重已重新归一化。
软件包维护
92优秀
评分方式
| 25/25 | 已发布且可解析 — go 上有 3 个软件包 |
| 35/35 | 发布时效 — 最近一次发布于 2 天前 |
| 12/20 | 版本历史 — 2 个已发布版本 |
| 20/20 | 未被弃用 — 活跃，未被弃用或撤回 |
所用输入
| packages | github.com/deadpoets/secmem, github.com/deadpoets/secmem/secmem-lint, github.com/deadpoets/secmem/secmem-crypto |
| ecosystems | go |
| any_deprecated | 否 |
| min_days_since_publish | 2 |
工程质量
基础的工程与文档实践是否到位？
74
工程实践
90优秀
评分方式
| 24/24 | CI 工作流 — 2 个工作流 |
| 24/24 | 存在测试 |
| 16/16 | Linter 配置 — .golangci.yml |
| 0/9.6 | Pre-commit 钩子 |
| 6.4/6.4 | .editorconfig |
| 20/20 | OpenSSF Scorecard：CI-Tests — 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 |
所用输入
| has_ci | 是 |
| has_tests | 是 |
| has_editorconfig | 是 |
| has_linter_config | 是 |
| has_precommit_config | 否 |
文档
50中等
评分方式
| 30/30 | README |
| 0/25 | 文档目录 |
| 0/15 | 文档 / 主页站点 |
| 10/10 | 仓库描述 |
| 10/10 | 主题标签 — 12 个主题标签 |
| 0/10 | Wiki |
所用输入
| topics | cryptography, go, golang, hardening, key-management, memory-safety, mlock, secret-management, secrets, secure-memory, security, memfd-secret |
| has_wiki | 否 |
| homepage | — |
| has_readme | 是 |
| has_docs_dir | 否 |
| has_description | 是 |
安全
可见的安全与供应链实践是否稳固，且不存在未解决的高风险司法辖区暴露？
74
安全态势
70良好
评分方式
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 6/7.5 | Branch-Protection — branch protection is not maximal on development and all release branches |
| 2.5/2.5 | CI-Tests — 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/29 approved changesets -- score normalized to 0 |
| 0/2.5 | Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 7.5/7.5 | Dependency-Update-Tool — update tool detected |
| 5/5 | Fuzzing — project is fuzzed |
| 2.5/2.5 | 许可证 — license file detected |
| 0/7.5 | Maintained — project was created within the last 90 days. Please review its contents carefully |
| 0/5 | Packaging — 无数据 |
| 4/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 8 |
| 0/5 | SAST — SAST tool is not run on all commits -- score normalized to 0 |
| 5/5 | Security-Policy — security policy file detected |
| 0/7.5 | Signed-Releases — 无数据 |
| 7.5/7.5 | Token-Permissions — GitHub workflow tokens follow principle of least privilege |
| 6.8/7.5 | Vulnerabilities — 1 existing vulnerabilities detected |
所用输入
| source | openssf_scorecard |
| checks_evaluated | 16 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 2 |
| scorecard_aggregate | 6.9 |
已排除计分（无数据或不适用）：packaging, signed_releases。 其余权重已重新归一化。
依赖安全公告
89优秀
评分方式
| 26.6/35 | 直接依赖不含已知公告 — 1 个受影响：golang.org/x/crypto v0.54.0 (unknown) |
| 0/25 | 间接依赖不含已知公告 — 在此范围内，传递依赖集合无法与开发和测试依赖区分 |
| 40/40 | 没有长期未处理的公告 — 没有公告公开超过 90 天 |
所用输入
| source | osv |
| advisories | 1 |
| affected_packages | 1 |
| assessed_packages | 7 |
| unassessed_packages | 0 |
| affected_by_severity | unknown 1 |
| direct_affected_packages | 1 |
已排除计分（无数据或不适用）：间接依赖不含已知公告。 其余权重已重新归一化。 已将 7 个已解析依赖与 OSV 比对。 该仓库未发布任何索引可解析的软件包，因此改为评估仓库依赖图。该图将开发与测试版本固定同交付的依赖混在一起，因此仅对声明的运行时依赖计分；传递性发现仅作为背景信息列出，不计入评分。 未对可达性进行分析。
AI 就绪度
该仓库在多大程度上具备与 AI 编码代理协同开发与维护的条件？这是一枚独立的实验性徽章——权重为 0.0，因此单独呈现，不影响总体健康评分。
68
AI 代理上下文与指引
40存在风险
评分方式
| 0/45 | 代理指令 — 没有 CLAUDE.md / AGENTS.md / 编辑器规则 |
| 0/15 | 机器可读文档（llms.txt） |
| 40/40 | 可读的提交历史 — 63 次人类提交中有 63 次说明了意图（结构化标题或解释性正文） |
所用输入
| has_llms_txt | 否 |
| legible_history_share | 1 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
评分方式
| 18/18 | 一条命令的引导启动 — Makefile |
| 22/22 | 自动化测试 |
| 11/11 | Lint / 格式化配置 — .golangci.yml |
| 11/11 | 静态类型检查 — Go（静态类型） |
| 10/10 | 可复现环境 — lockfile |
| 0/10 | 已体现的代理实践 — 最近 69 次提交中没有代理编写的提交 |
| 8/8 | 自动化维护 — 最近 69 次提交中有 6 次为自动依赖更新 |
| 8/10 | OpenSSF Scorecard：Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 8 |
所用输入
| has_nix | 否 |
| has_tests | 是 |
| lockfiles | go.sum |
| has_dockerfile | 否 |
| typed_language | 是 |
| bootstrap_files | Makefile |
| has_devcontainer | 否 |
| has_linter_config | 是 |
| typecheck_configs | — |
| agent_commit_share | 0 |
| toolchain_manifests | examples/go.mod, go.mod, secmem-crypto/go.mod, secmem-lint/go.mod |
| dependency_bot_commit_share | 0.087 |
面向模型的代码可读性
100优秀
评分方式
| 45/45 | 可类型检查的代码 — Go（静态类型） |
| 55/55 | 可控的文件大小 — 采样的 148 个源文件中有 0 个超过 60KB |
所用输入
| primary_language | Go |
| largest_source_bytes | 22,634 |
| source_files_sampled | 148 |
| oversized_source_files | 0 |
机器可读接口
40存在风险
评分方式
| 0/40 | API 模式（OpenAPI/GraphQL/proto） |
| 0/20 | MCP 服务器 |
| 40/40 | 可运行示例 — examples |
所用输入
| example_dirs | examples |
| has_mcp_signal | 否 |
| api_schema_files | — |
关键数据
1GitHub 星标
1贡献者
69最近 12 个月提交数
2距最近推送天数
2发布版本数
1巴士系数（bus factor）
1开放议题
Go软件包生态系统数
数据采集警告
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
更多细节
OpenSSF Scorecard 6.9 / 10
6.9综合
来自开源项目 OpenSSF Scorecard 的独立、工具无关的安全评估。每项检查奖励的是安全实践本身，而非特定供应商的工具。Scorecard 无法判定的检查项标记为 不适用，并从安全评分中剔除（绝不按零分计）。
| 10 | Binary-Artifacts | no binaries found in the repo |
| 8 | Branch-Protection | branch protection is not maximal on development and all release branches |
| 10 | CI-Tests | 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/29 approved changesets -- score normalized to 0 |
| 0 | Contributors | project has 0 contributing companies or organizations -- score normalized to 0 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 10 | Dependency-Update-Tool | update tool detected |
| 10 | Fuzzing | project is fuzzed |
| 10 | License | license file detected |
| 0 | Maintained | project was created within the last 90 days. Please review its contents carefully |
| 不适用 | Packaging | packaging workflow not detected |
| 8 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 8 |
| 0 | SAST | SAST tool is not run on all commits -- score normalized to 0 |
| 10 | Security-Policy | security policy file detected |
| 不适用 | Signed-Releases | no releases found |
| 10 | Token-Permissions | GitHub workflow tokens follow principle of least privilege |
| 9 | Vulnerabilities | 1 existing vulnerabilities detected |
直接依赖 5
| 注册表 | 软件包 | 版本约束 | 清单文件 |
|---|---|---|---|
| Go | golang.org/x/sys | v0.47.0 | go.mod |
| Go | filippo.io/edwards25519 | v1.2.0 | secmem-crypto/go.mod |
| Go | github.com/deadpoets/secmem | v0.2.0 | secmem-crypto/go.mod |
| Go | golang.org/x/crypto | v0.54.0 | secmem-crypto/go.mod |
| Go | golang.org/x/tools | v0.48.0 | secmem-lint/go.mod |
全部依赖 7
来自 GitHub 依赖图的完整解析依赖集合：5 个直接依赖与 2 个间接（传递）软件包。仓库提交锁文件时，传递闭包才是完整的。
| 注册表 | 软件包 | 版本 | 关系 |
|---|---|---|---|
| Go | filippo.io/edwards25519 | v1.2.0 | 直接 |
| Go | github.com/deadpoets/secmem | v0.2.0 | 直接 |
| Go | golang.org/x/crypto | v0.54.0 | 直接 |
| Go | golang.org/x/sys | v0.47.0 | 直接 |
| Go | golang.org/x/tools | v0.48.0 | 直接 |
| Go | golang.org/x/mod | v0.38.0 | 间接 |
| Go | golang.org/x/sync | v0.22.0 | 间接 |
依赖安全公告 1
该仓库未发布可被索引解析的包，因此评估的是其自身的依赖图——共 7 个包，其中也包含从不交付的开发与测试版本固定：1 个存在已知公告，1 个为直接依赖。
| 软件包 | 版本 | 关系 | 严重程度 | 公告数 | 修复版本 |
|---|---|---|---|---|---|
| golang.org/x/crypto | v0.54.0 | 直接 | 未知 | 1 | — |
公告表示依赖图中记录的版本落入某条公告的受影响范围。可达性未经分析，且依赖图包含开发与测试的版本固定——某项发现可能只涉及工具链而非交付的软件。
原始 JSON 报告 机器可读
{
"data": {
"repo": {
"topics": [
"cryptography",
"go",
"golang",
"hardening",
"key-management",
"memory-safety",
"mlock",
"secret-management",
"secrets",
"secure-memory",
"security",
"memfd-secret"
],
"is_fork": false,
"size_kb": 577,
"has_wiki": false,
"homepage": null,
"languages": {
"Go": 679364,
"Assembly": 13785,
"Makefile": 2495
},
"pushed_at": "2026-07-21T00:57:08Z",
"created_at": "2026-07-12T18:17:03Z",
"owner_type": "User",
"updated_at": "2026-07-21T00:56:12Z",
"description": "Pure-Go off-heap secret memory: mmap/mlock, memfd_secret L4 isolation, guard pages, fail-closed by default",
"is_archived": false,
"is_disabled": false,
"license_spdx": "Apache-2.0",
"default_branch": "main",
"license_spdx_raw": "Apache-2.0",
"primary_language": "Go",
"significant_languages": [
"Go"
]
},
"owner": {
"blog": null,
"name": "Chris",
"type": "User",
"login": "deadpoets",
"company": null,
"location": "Florida",
"followers": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/7587613?v=4",
"created_at": "2014-05-15T02:24:51Z",
"is_verified": null,
"public_repos": 20,
"account_age_days": 4452
},
"license": {
"state": "standard",
"spdx_id": "Apache-2.0",
"raw_spdx": "Apache-2.0",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.2.0",
"kind": "minor",
"published_at": "2026-07-20T00:43:23Z"
},
{
"tag": "v0.1.0",
"kind": "minor",
"published_at": "2026-07-17T00:16:09Z"
}
],
"recent_commits": [
{
"oid": "f006acc0001ce27ba6b1462d66510595b962f5f8",
"body": "Dependency-only release so **crypto-only consumers get the crash fix**.\n\n`secmem-crypto` v0.1.0 pins `secmem v0.1.0`, so anyone importing only\nthis module still resolves the core that faults the process when a\nmutating call follows `ReadOnly()`. Bumping the `require` propagates the\nfix without touch\n[…]\nn this repo.\n\nTag after merge:\n```\ngit tag -s secmem-crypto/v0.2.0 -m \"...\"\ngit push origin secmem-crypto/v0.2.0\n```\n\n---------\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "build(secmem-crypto): require secmem v0.2.0 (secmem-crypto/v0.2.0) (#40)",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-21T00:56:08Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "63fbce940d03e79838339bb590a8777c45307d00",
"body": "Docs-only release prep for **v0.2.0**. No library or test code changes —\nthis is the CHANGELOG cut plus the KERNELS evidence rows, so it can land\nimmediately before tagging.\n\n## Why v0.2.0 now\nv0.1.0 ships a **process-crashing defect**: `ReadOnly()` followed by\n`CopyIn`/`SetByteAt`/`Truncate`/`ReadF\n[…]\nring.\n\n## Not included\nNo tags. `v0.2.0` and the follow-up `secmem-crypto/v0.1.1` are yours to\ncut — immutable refs, no bypass.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "docs: cut the v0.2.0 changelog and record its verified kernels (#39)",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-20T23:39:59Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4cc2beb83c0d53980a703a04c62f9797c35b3b55",
"body": "Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.5.0\nto 7.0.0.\n<details>\n<summary>Release notes</summary>\n<p><em>Sourced from <a\nhref=\"https://github.com/actions/setup-go/releases\">actions/setup-go's\nreleases</a>.</em></p>\n<blockquote>\n<h2>v7.0.0</h2>\n<h2>What's Changed</h2>\n<ul>\n[…]\nnless you reopen the\nPR or upgrade to it yourself)\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 (#38)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-20T00:42:15Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f7fdf4e2872b8c03e50f15b0646ba7944bdaca57",
"body": "## Summary\n\nFuzzing-maturity follow-ups to #35, motivated by the read-only fault the\nlifecycle fuzzer found.\n\n> **Stacked on #35** — base branch is `fix/readonly-write-fault`,\nbecause this uses that PR's lifecycle fuzzers and its\n`Seal`-on-read-only fix. **Retarget to `main` once #35 merges.**\n\n## W\n[…]\nonce it's on\n`main`; use **Run workflow** (workflow_dispatch, with a tunable\nper-target budget) to trigger it manually anytime.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "ci: nightly fuzzing, seed corpora, and a signer-lifecycle fuzzer (#36)",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-19T20:36:42Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "535d6a36be1201382f7319be09a3c16ba0c50511",
"body": "…istic (#37)\n\n## Summary\n\nFixes a flaky test I introduced in #35.\n`TestArena_ConcurrentReadOnlyRelease` failed on **macOS** in CI:\n\n```\nsecurearena_test.go:777: Acquire after stress: secmem: secure arena is full — no free slots\n```\n\n## Cause\n\nThe test let a worker **give up** on a slot after 100 ref\n[…]\nleaving.\n\nNote: #36 (nightly fuzzing) is currently red for this same reason and\nwill go green once this lands — I'll rebase it.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "test: drain refused slots so the arena concurrency stress is determin…",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-19T20:35:18Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2111fef8fbdb1aa2daa33296b6d4e1816c6fe2c0",
"body": "…ting (#35)\n\n## Summary\n\n`SecureBuffer.ReadOnly()` sets the region to `PROT_READ`, but the\nmutating methods did not check for it — so a write issued after\n`ReadOnly()` reached the read-only page and **crashed the process with\nSIGSEGV**, violating the \"misuse returns an error, never crashes\"\ncontract\n[…]\namples/password-login/`, added in a sibling PR. Merge that first or\ntogether, or those two links 404 until it lands.\n\n---------\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "fix: refuse mutations on read-only buffers and arenas instead of faul…",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-19T20:07:09Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "750f8dfadf1070a5ec053126d4a670eade84eea6",
"body": "## Summary\n\nAdds an `examples/` module with two runnable, end-to-end programs and\nwires it into CI.\n\n- **`password-login`** — a register/login flow demonstrating the\nwipe-after-use and constant-time-comparison idioms (`SecureWipe`,\n`NewEmptyBuffer`, `Argon2DeriveInto`, `ConstantTimeEqual`) in ~150\nl\n[…]\nhe kernel-invisible path\nwas actually exercised.\n- Cross-compiles darwin/arm64 + linux/arm64; `password-login` runs on\nWindows.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "feat: add runnable examples (password-login, hardened-ssh-agent) (#34)",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-19T20:05:06Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f0d4e229e8e2f1ccacddb82ba3950116dfff0a3e",
"body": "Adds the conventional CI/build-status badge, between the existing Go\nReference and Go Report Card badges:\n\n```\n[](https://github.com/deadpoets/secmem/actions/workflows/ci.yml)\n```\n\nRenders the green \"CI passing\" pill from the Actions workflow on main.\nREADME-only.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "docs: add a CI status badge to the README (#33)",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-19T13:35:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7b6fb74f6b9bc8cb0a7719bc2f7f3884b16bfae1",
"body": "Post-public cleanup. The `GOPRIVATE` env and the job-token git auth\n(`insteadOf`) existed only so CI could read the **private** secmem\nmodule's `go.mod`. Now that the repo is public, the modules resolve\nthrough the public proxy and `sum.golang.org` exactly like a downstream\nconsumer's would — so rem\n[…]\nxy/sumdb.\n\nNo library or test change — CI plumbing only. This PR's own run is the\nproof the public proxy path works end-to-end.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "ci: drop the private-fetch scaffolding now that the repo is public (#31)",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-18T15:36:20Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f7f74653963f80f8ae5276524f9604b1f9c806fa",
"body": "…retmem live) (#30)\n\nFull v0.1.0 gauntlet **PASS** on a genuinely different arm64 target — a\nLibre Computer Renegade (Rockchip **RK3328**, 4× **Cortex-A53**) on\nArmbian, kernel **6.18.35**, `CONFIG_SECRETMEM=y`.\n\n**Result:** both modules under `-race`, `GOEXPERIMENT=runtimesecret`,\nthe no-heap-escap\n[…]\nfrom the pre-public polish (#29) so that one stays as-reviewed;\nthe two touch different parts of KERNELS.md and rebase cleanly.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "docs: add the in-order Cortex-A53 arm64 row (RK3328, kernel 6.18, sec…",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-18T04:24:13Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "167b4749ee025dd360769ce157193139dcc0b5a5",
"body": "… internal-ref scrub (#29)\n\nOutput of a final pre-public documentation vet: an 8-dimension\nmulti-agent audit of the whole tracked tree, every finding adversarially\nre-verified against real committed content. **Zero blockers** — no\n`galathine` leak, no secret, no security overclaim, no competitor sha\n[…]\ngolangci-lint (0 issues), actionlint, gitleaks. No library behavior\nchanges — docs and comments only, plus one CHANGELOG entry.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "docs: pre-public polish — arm64 memfd accuracy, threat-model honesty,…",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-18T04:20:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "372c8b72f5781dbf1a4ed27dbf88e175049e132a",
"body": "…on artifact) (#28)\n\n## What\n\nAdds `&& !asan` to `TestScrub_ScrubsShallowCallTree`'s build constraint,\nwith a comment explaining why.\n\n## Why\n\nRunning the v0.1.0 release-validation gauntlet on real amd64 hardware\n(Hyper-V VM, kernel `7.0.0-1009-azure`, Go 1.26.5) surfaced this as the\n**sole `-asan` \n[…]\n exercised everywhere else.\n\n## Result\n\nThe amd64 `-asan` stage now passes clean, unblocking the amd64\nKERNELS.md row (PR #27).\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "test: exclude the legacy stack-scrub proof under -asan (instrumentati…",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-17T04:08:24Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "047afa6f1cfd5165b348203cd80c9c5c3fb5d4a1",
"body": "The matrix now records what shipped, per today's release:\n\n- **v0.1.0-only table** — executed against tree `06960fb` (the released\nlibrary code, crypto exactly as its tag). First row: fresh full gauntlet\non **real arm64 silicon** (OCI Ampere A1.Flex, kernel\n`6.17.0-1011-oracle`, secretmem live) — bo\n[…]\n60fb`, test-time `replace` bridge for\noffline sibling resolution (no repo credentials placed on the disposable\nbox).\n\n---------\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "docs: rebaseline KERNELS.md on the v0.1.0 release run (#27)",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-17T03:53:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2c87a1ca4f5f5e7567ad439282aec7aeb2dfd82b",
"body": "The version-discipline half of today's supply-chain hardening (the\nsettings half — tag ruleset, Actions allowlist, Dependabot security\nupdates — is already applied repo-side):\n\n- New **apicompat** job: `gorelease` diffs each module's exported API\nagainst its latest published tag; the report lands in\n[…]\n Actions allowlist\n(all three third-party actions run here). Not added to required contexts\n(deliberate, see above).\n\n---------\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "ci: apicompat job — gorelease each module against its latest tag (#26)",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-17T01:19:44Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "06960fba6993f92655775ad507589febf9e29598",
"body": "…ge (#25)\n\nThe release-ordering follow-through now that `v0.1.0` exists:\n\n- **secmem-crypto/go.mod**: requires `github.com/deadpoets/secmem\nv0.1.0`; the development `replace => ../` bridge is gone. go.sum carries\nthe tag's hashes. Consumability proven locally with a `GOWORK=off go\nbuild` that resolv\n[…]\ngolangci-lint, secmem-lint dogfood both modules, gitleaks.\n\nTag `secmem-crypto/v0.1.0` gets cut on the merge commit.\n\n---------\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "build(secmem-crypto): require secmem v0.1.0 and drop the replace brid…",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-17T00:37:13Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2faf99c38c2e48d223b292627a808c2b222b24ff",
"body": "…1.0 (#24)\n\nRelease prep for the first core tag, per the release plan's Phase-4\nchecklist:\n\n- **SECURITY.md**: adds the required audit-status disclosure — secmem\nhas not had an independent third-party security audit; what\nself-verification exists is documented in TESTING.md, and that is not an\naudit\n[…]\n(next PR, which also drops the go.mod `replace`\nbridge).\n\nDocs-only; no code change. Tag `v0.1.0` gets cut on the merge commit.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "docs: state the not-audited status and cut the changelog for core v0.…",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-17T00:16:09Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3403fe8a91e7d8dfca68d63d59b1a0e23bbdee48",
"body": "## Summary\n\n\"Generate a credential directly into locked memory, never as a heap\nstring\" is squarely this library's mission, and generated-passphrase\nsupport was missing entirely.\n\nDraws from the **EFF long wordlist** (7776 words, ~12.9 bits of entropy\neach) rather than BIP-39's, for two independent \n[…]\neclared`-shadowing finding — a local var\nnamed `max`, renamed), `gitleaks`, and the `secmem-lint` dogfood all\nclean.\n\n---------\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(secmem-crypto): GenerateDicewarePassphrase (#23)",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-16T04:12:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c8271c3a9370c1e723c957d2fc54c51a55d20a80",
"body": "## Summary\n\n`kdf.go` had Argon2 (password stretching) and full HKDF\n(Extract-then-Expand), but no way to compute a plain keyed\n`HMAC-SHA256(key=secret, msg=info)` for domain-separated subkey\nderivation from an already-uniform master secret.\n\n**The gap has a real footgun.** HKDF's own Extract step is\n[…]\n.\n- Full suite, `-race`, `vet`, `staticcheck`, `golangci-lint` (0 issues),\n`gitleaks`, and the `secmem-lint` dogfood all clean.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(secmem-crypto): HMACInto/HMACSHA256Into, a raw keyed-HMAC PRF (#22)",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-16T04:02:36Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7e8d9c806a9ca194d09e2cfbbe3296fde7d1c8c4",
"body": "## Summary\n\n`AsSSH` covers signing over a live connection without ever exporting key\nmaterial. There was no matching path for the complementary case:\npersisting a generated key as a portable OpenSSH private-key file.\nWithout this, a caller has to borrow the raw seed via `WithSeed` and\nre-implement P\n[…]\n 5 test) — all deliberate, each annotated with\n`//nolint:secmem-lint` and a reason, matching the project's existing\nconvention.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(secmem-crypto): Ed25519Signer.MarshalOpenSSHPrivateKey (#21)",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-16T01:18:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a69a7483fc4caa21a50a158a50226bd15a1633f2",
"body": "## Summary\n\n`Secret` already redacts to `\"[REDACTED]\"` under every `fmt`/`slog`\npath. This wires the same protection into `SecureBuffer`, `SecureArena`,\nand `ArenaSlot`, which had none — printing one of them today faults\ninstead: `fmt`'s default struct printer reflects into the guarded,\nmmap'd regio\n[…]\nssues),\n`gitleaks`, and the `secmem-lint` dogfood all clean; `secmem-crypto`\nstill builds and passes against the modified core.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "fix: redact SecureBuffer/SecureArena/ArenaSlot under fmt and slog (#20)",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-15T16:24:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b7b85b21d8bd3a457bc6ceddcd9249e0da8aad1e",
"body": "## Summary\n\nIncrement 3 (opt-in `-strict` checks) plus the module README (Increment\n4's docs).\n\n### `-strict` (off by default)\nTwo heuristic, higher-noise checks behind the `-strict` flag:\n- **L1** — a locally constructed `SecureBuffer` / signer / key that is\nnever `Destroy`ed and never handed off (\n[…]\ng **`secmem-lint/v0.1.0`**. The module imports neither\nsecmem module, so it is independent of the core/crypto release ordering.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "feat: add secmem-lint -strict checks (L1, N1) and a README (#19)",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-14T22:45:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "dd3fc6851269bb295ef6cda04be0a9fc0ead3a0d",
"body": "## Summary\n\nRuns the `secmem-lint` analyzer (added in #15, adopted in #16) in CI and\ndogfoods it over both library modules, so the borrowing-closure\ndiscipline is enforced on every push.\n\n### CI (`.github/workflows/ci.yml`)\n- **New `secmem-lint` job** — runs the analyzer's analysistest suite,\nbuilds\n[…]\nin CI (real infra cost) for marginal benefit now that the\ndedicated `secmem-lint` job enforces the analyzer. Easy to add later.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "ci: wire secmem-lint into CI and the Makefile (#18)",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-14T21:22:33Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a779a754789f7982292c8844e5050fc273fdad1b",
"body": "## Summary\n\nAdopts **`secmem-lint`** (#15) across both modules so each passes the\nanalyzer\ncleanly. Running the tool surfaced **12 borrowed-byte egresses, all in\ntest and\nexample code** — every one triaged and handled here. **No production\ncode\nchanges** (only `_test.go` / `example_test.go`).\n\n### R\n[…]\nin —\nwhich both\n> silences the warning and runs the analyzer inside the lint job — comes\nwith\n> the CI-wiring change, not here.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "test: adopt secmem-lint across both modules (#16)",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-14T21:03:47Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "53f4da32fe3802813b0702d2eff8874356115c82",
"body": "…86 flake) (#17)\n\n## Summary\n\nFixes the rare `test-386-linux` flake in the guard/canary overflow\nproofs (it\nalso affects every other platform \n\n**Root cause.** The overflow proofs corrupt the canary slack by writing\na fixed\nbyte (`0x00`, one site `0xFF`), then require `Destroy`/`Release` to\nreport\n`\n[…]\n processes** (a new random\npattern\neach run). Full core suite, `staticcheck`, `golangci-lint` (0 issues),\nand\n`gitleaks` clean.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "test: make canary-overflow corruption deterministic (fix rare linux/3…",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-14T05:46:54Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ba7f1f13b07c517af720cbf58dba962cd3ebf392",
"body": "## Summary\n\nAdds **`secmem-lint`** (Phase 3), a `go/analysis` analyzer that flags\nsecret\nmaterial escaping a secmem borrowing closure — the discipline the\nlibrary\ndocuments in prose and proves for its own code at run time, now\nenforceable at\n**compile time in consumer code**.\n\nThis PR is the **analy\n[…]\ncrypto`\ntrees\nalready surfaces the expected intentional test/example egresses — those\nare\nhandled in the follow-up adoption PR.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "feat: add secmem-lint, a borrowing-closure escape analyzer (#15)",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-14T05:11:33Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9eb7e25b9ea4a262d4d46b70cfcb056e156396a5",
"body": "…#14)\n\n## Summary\n\nA small documentation follow-up to #13. The opt-in termination-wipe\nchange in\nthat PR removed the auto-installed `SIGTERM`/`SIGINT`/`SIGQUIT` handler\nbut left\nseveral comments — and two package-doc lines — still describing the old\nautomatic behavior. This makes the docs match the \n[…]\n `go test ./...` (both packages),\n`staticcheck`,\n`golangci-lint` (0 issues), and `gitleaks` all clean on the current main\nbase.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "docs: align emergency-wipe comments with the opt-in signal redesign (…",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-14T05:08:18Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "262175739a66006fd8dacc0fef7396213e16120a",
"body": "…t fixes (#13)\n\n## Summary\n\nA pre-release security pass across both modules. It promotes the\nout-of-process\nextraction proof into the tree as a committed regression test, fixes six\nmemory-safety / residual-secret defects surfaced by an adversarial\naudit, and\nmakes the process-global signal janitor o\n[…]\ne skips one\npre-existing\nscrub test that ASan's fake stack cannot host — a tooling artifact;\nclean\nwithout `-asan`.)\n\n---------\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "Pre-release security hardening: extraction proof + memory-safety audi…",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-14T03:08:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "71e7fc0f075e16a7ffae16088f27f2e4b6962451",
"body": "…wipe proof (#12)\n\nTurns several verification claims from \"reported\" or \"argued\nstructurally\" into invariants CI enforces, and adds a claims-to-proofs\nmatrix. Prompted by a testing-methodology review against how the field\n(libsodium/BoringSSL/Go-FIPS) and the standards (NIST ACVP, FIPS 140-3\nzeroiza\n[…]\nry test file referenced in\nTESTING.md verified to exist; the pinned ML-KEM digest verified\nbyte-identical to GOROOT.\n\n---------\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "Test hardening: runtimesecret CI, alloc gates, ML-KEM/GCM KATs, live-…",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-14T00:00:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1b0ab0c8f74d74996e1feb9cbc7e4d326bdb9cf3",
"body": "## 1. Adoption-target examples\n\nTwo runnable `Example` functions at the \"plug into a stdlib/x-crypto\nconsumer\" altitude\n- `ExampleECDSASigner_tlsCertificate` — self-sign an `x509.Certificate`,\nassemble a `tls.Certificate` (what `tls.Config.Certificates` expects).\n- `ExampleAsSSH_hostKey` — wire a si\n[…]\nir\n`Output` checks, staticcheck + golangci-lint 0 issues, cross-compile\n(linux/386, linux/arm64, darwin/arm64), gitleaks clean.\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "secmem-crypto: adoption examples, naming-honesty pass, PQ posture (#11)",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-13T11:47:52Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f9697e2ed057396861d995e72efc39a7dc87f783",
"body": "## What\n\nPhase 2, block 3 of `secmem-crypto` — the caveated signers that round\nout the `crypto.Signer` surface, plus the SSH adapter:\n\n- **`ECDSASigner`** (P-224/P-256/P-384/P-521): raw scalar at rest in a\n`SecureBuffer`; each Sign transiently materializes a stdlib key via\n`ecdsa.ParseRawPrivateKey`\n[…]\nhared sentinel with `Key32`).\n- RSA keygen now wipes the intermediate DER even when `SecureBuffer`\nallocation fails.\n\n---------\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "secmem-crypto block 3: ECDSA and RSA signers, AsSSH (#9)",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-13T04:56:47Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "db76de3a62c3a5cb87d255459e9139f902385a35",
"body": "Second block of Phase 2. Adds OpenInto/SealInto (the SM1 fix — decrypt\ndirectly into a SecureBuffer, measured 0 allocs, tamper-zeroed), Key32\n(X25519 DH, RFC 7748 vectors, low-order-point rejection), and\nMLKEM768Key (post-quantum ML-KEM-768 seed custody). Plus runnable\nexamples, fuzz targets, and be\n[…]\nonesty precision issues, now fixed. Test-coverage\nbackfill (fuzz + benchmarks) added since one review lens misfired.\n\n---------\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "secmem-crypto block 2: AEAD, X25519, ML-KEM (#8)",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-13T03:46:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "374db53f463656bb6caff56c5f9393133f11a628",
"body": "Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.6.0\nto 6.5.0.\n<details>\n<summary>Release notes</summary>\n<p><em>Sourced from <a\nhref=\"https://github.com/actions/setup-go/releases\">actions/setup-go's\nreleases</a>.</em></p>\n<blockquote>\n<h2>v6.5.0</h2>\n<h2>What's Changed</h2>\n<h3>\n[…]\nnless you reopen the\nPR or upgrade to it yourself)\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump actions/setup-go from 5.6.0 to 6.5.0 (#7)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-13T03:46:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "29eacbc3cd6338967959378cc21d37fc324920ac",
"body": "New sibling module: Ed25519 Signer (crypto.Signer/MessageSigner, seed in\nSecureBuffer, forced RFC 8032 workaround differentially fuzzed vs\nstdlib), full-surface HKDF (RFC 5869 TC1-3), validated Argon2id (RFC\n9106-aligned frozen defaults), WithSeed persistence egress, WipeScalar.\nReviewed by a 38-age\n[…]\nthe module into CI/Makefile/Dependabot\n(multi-module ./... boundary) with stable job names and a linux/386\ntripwire.\n\n---------\n\nCo-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "Add the secmem-crypto module (Phase 2, block 1) (#6)",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-13T03:46:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b198e3bca0e0aa7fef34610b241bb9885b300dc1",
"body": "Bumps\n[gitleaks/gitleaks-action](https://github.com/gitleaks/gitleaks-action)\nfrom 2.3.9 to 3.0.0.\n<details>\n<summary>Release notes</summary>\n<p><em>Sourced from <a\nhref=\"https://github.com/gitleaks/gitleaks-action/releases\">gitleaks/gitleaks-action's\nreleases</a>.</em></p>\n<blockquote>\n<h2>v3.0.0</\n[…]\nr />\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\nCo-authored-by: Chris <deadpoets@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump gitleaks/gitleaks-action from 2.3.9 to 3.0.0 (#2)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-13T03:46:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ad2622c11d25a1f71a24d682fd6d41cb6cff1f61",
"body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1\nto 7.0.0.\n<details>\n<summary>Release notes</summary>\n<p><em>Sourced from <a\nhref=\"https://github.com/actions/checkout/releases\">actions/checkout's\nreleases</a>.</em></p>\n<blockquote>\n<h2>v7.0.0</h2>\n<h2>What's Changed</h2>\n<ul>\n[…]\nils>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\nCo-authored-by: Chris <deadpoets@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump actions/checkout from 4.3.1 to 7.0.0 (#3)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-13T03:46:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b30029457bd0256dc684d146b4361dae4ee48034",
"body": "Bumps\n[golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action)\nfrom 7.0.1 to 9.3.0.\n<details>\n<summary>Release notes</summary>\n<p><em>Sourced from <a\nhref=\"https://github.com/golangci/golangci-lint-action/releases\">golangci/golangci-lint-action's\nreleases</a>.</em></p>\n<bloc\n[…]\nils>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\nCo-authored-by: Chris <deadpoets@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump golangci/golangci-lint-action from 7.0.1 to 9.3.0 (#4)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-13T03:46:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ea53984b7f5e941dfe8a9ab1d515c9c6cc0fb5cd",
"body": "Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.6.0\nto 6.5.0.\n<details>\n<summary>Release notes</summary>\n<p><em>Sourced from <a\nhref=\"https://github.com/actions/setup-go/releases\">actions/setup-go's\nreleases</a>.</em></p>\n<blockquote>\n<h2>v6.5.0</h2>\n<h2>What's Changed</h2>\n<h3>\n[…]\nnless you reopen the\nPR or upgrade to it yourself)\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump actions/setup-go from 5.6.0 to 6.5.0 (#5)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-13T03:46:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ad8f9cbd33e6783174911666ac1fbd731b0a1e38",
"body": "Records the suite executing on real Windows 11 hardware and Windows\nServer 2022 (CI), including guard-fault/canary/WER/seal/hardening\nproofs. Discloses Windows 10 as not yet verified.\n\n---------\n\nChris Fink <7587613+deadpoets@users.noreply.github.com>",
"is_bot": false,
"headline": "Add WINDOWS.md: real-hardware verification log (#1)",
"author_name": "Chris",
"author_login": "deadpoets",
"committed_at": "2026-07-13T03:46:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4d03c77d745b0650e3b6995279ea62193d043f1f",
"body": "v6 hard-rejects any v2.x golangci-lint version string outright\n(\"golangci-lint v2 is not supported by golangci-lint-action v6\") — not a\nresolution quirk like the prior two fixes, the action itself never\nsupported it. v7 does.",
"is_bot": false,
"headline": "Bump golangci-lint-action to v7 for v2 config support",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-13T03:46:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6ebff07fdbd065579157ae515716fe6a1a558a26",
"body": "golangci-lint-action's \"latest\" resolved to v1.64.8, which speaks the v1\nconfig schema — but .golangci.yml uses the v2 schema (version: \"2\",\nlinters.default, a formatters block), matching the v2.12.2 binary\ninstalled locally. The mismatch wasn't a Go-version problem as the first\nerror suggested; goi\n[…]\nlt v1.64.8 from source against\ngo1.26, and *that* binary then rejected our v2-schema config outright.\nPinning the action to the same major.minor as the local dev toolchain\nfixes both symptoms at once.",
"is_bot": false,
"headline": "Pin golangci-lint to v2.12.2 in CI",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-13T03:46:15Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3a7ce179f00e5f634efff177f7487cfe654fbf23",
"body": "The first real run on GitHub Actions surfaced two workflow bugs:\n\n- test/test-arm64-linux ran bare \\`go vet\\`, which doesn't see\n .golangci.yml's documented exclusions for the known-safe unsafe.Pointer\n cases (OS-owned addresses, guard-page/dead-stack proof tests) — so it\n failed on exactly the f\n[…]\n pulled a prebuilt golangci-lint binary built with go1.24,\n which can't parse this module's go 1.26 directive. install-mode:\n goinstall builds it from source against the job's own toolchain instead.",
"is_bot": false,
"headline": "Fix CI: drop redundant go vet, build golangci-lint from source",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-13T03:46:15Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "bc9111b5df478ee18502eb55ce6f8cf101b86d71",
"body": "Wires up what branch protection will enforce: CODEOWNERS makes @deadpoets\nreview mandatory on every PR (including the maintainer's own, once\nprotection applies to admins too). CONTRIBUTING.md documents the workflow,\nlocal check commands, and the commit-signing requirement. SECURITY.md\nroutes vulnera\n[…]\novenant\n2.1. Issue templates split bug reports from feature requests and redirect\nsecurity reports and usage questions away from the tracker; the PR\ntemplate checklist mirrors what CI actually checks.",
"is_bot": false,
"headline": "Add repo governance: CODEOWNERS, CONTRIBUTING, CoC, SECURITY, templates",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-13T03:46:15Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d7c2e56c6cbcc177325e4170b42c97ce9612fa49",
"body": "Matrix: go vet + race tests on linux/macos/windows amd64, plus a native\nlinux/arm64 runner. Separate cross-compile job builds and test-compiles\nfor darwin/arm64, darwin/amd64, windows/arm64, and linux/arm64 to catch\nplatform-specific compile errors even where a native runner isn't\navailable. Also wires golangci-lint, staticcheck, govulncheck, and a\ngitleaks secret scan into CI so the pre-push checks run on every push\nand PR, not just locally.",
"is_bot": false,
"headline": "Add GitHub Actions CI",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-13T03:46:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bf9c777983c0b4dd0ccdce8fb27806b8f39296dc",
"body": "Runs the full suite on real aarch64 silicon (Oracle Cloud Ampere A1.Flex)\nacross four kernels/distros, replacing the README's \"not yet run on real\narm64 hardware\" hedge with confirmed coverage across amd64+arm64,\nkernels 5.10 through 7.x.\n\nAdds ENVIRONMENTS.md documenting measured behavior across ro\n[…]\nce\nthat kernel version alone doesn't determine the L4 isolation path.\n\nAdds environment_test.go (TestReportEnvironment) as a standalone,\nno-code-required way to check Probe() output on any given host.",
"is_bot": false,
"headline": "Close the arm64 real-hardware coverage gap",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-13T03:46:15Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "acf902029aa11b69b1385e837ce9ece689d3c9dd",
"body": "TestMlockFailure_ReturnsErrorNotPanic set RLIMIT_MEMLOCK=0 and expected\nallocation to fail, but CAP_IPC_LOCK bypasses RLIMIT_MEMLOCK entirely, so\nthe test passed for the wrong reason (or not at all) under root and any\ncontainer runtime that grants the capability by default. The re-exec'd\nchild now drops CAP_IPC_LOCK before setting the rlimit, pinned to one OS\nthread; if the drop itself fails, the child reports inconclusive rather\nthan a false pass or panic.",
"is_bot": false,
"headline": "Fix negative mlock test to be valid under CAP_IPC_LOCK",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-13T03:46:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2ef617a91cb61a84cb61c8ddb59917dce2fcc1c8",
"body": "The reader-facing capstone, all of it verifiable or falsifiable.\n\nRunnable Example tests for both packages — the core lifecycle, Scope,\nSecret redaction, Probe, SecureArena, the Sanitizer, provider rules,\nand the slog Handler. They compile, run under go test, and render on\npkg.go.dev, so a doc that \n[…]\n path,\nsame syscall number) while disclosing that only amd64 has been executed\nso far, with KERNELS.md as the authoritative record. CHANGELOG.md\nfollows keep-a-changelog with the 0.x stability caveat.",
"is_bot": false,
"headline": "Add the docs: guarantee matrix, threat model, examples, changelog",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-13T03:46:15Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4700045b336cbfba164497b14e1104a599e92b56",
"body": "The guard-page rewrite dropped the architecture check on\nallocMemfdSecret. sysMemfdSecret (447) is the asm-generic syscall\nnumber and is correct only on 64-bit arches (amd64, arm64, riscv64); on\n32-bit linux that number is a different syscall entirely, so calling it\nunconditionally was wrong — at be\n[…]\nre the rewrite. On 64-bit\nthe check folds to a constant and the memfd path is unchanged (still\nverified against /proc/self/mem on amd64). All five linux arches\n(386, arm, amd64, arm64, riscv64) build.",
"is_bot": false,
"headline": "Restore the 64-bit guard on the memfd_secret path",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-13T03:46:15Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4ade3dac1ddd1ff2ef311a2c6f01a2d0c558e966",
"body": ".golangci.yml enables a curated linter set on top of the standard ones\n(govet, staticcheck, errcheck, ineffassign, unused): gosec — on-brand\nfor a security library — plus bodyclose, misspell, unconvert, unparam,\nnilerr, errorlint, copyloopvar, predeclared, and gofmt -s. The set is\ndeliberately not m\n[…]\nied with\ngolangci-lint and staticcheck across native, linux, darwin, windows,\nthe stub platform, and the runtimesecret path; govulncheck clean; go\nmod tidy/verify leave the x/sys-only graph unchanged.",
"is_bot": false,
"headline": "Add the in-repo lint configuration",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-13T03:46:15Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "108222ba9acf880c160eed40a8c1a0246d95375e",
"body": "The failure-mode promises are as load-bearing as the features, so they\nget proofs of their own.\n\nConstructors never panic on bad input — nil, empty, negative, and\noverflow sizes all return errors. Every buffer, arena, slot, and secret\nmethod is exercised on a nil receiver and after Destroy/Seal and \n[…]\n no surviving\ncontrol char, never panics) hold under fuzzing. The sanitizer fuzz\ntarget is what surfaced the truncation-idempotence bug fixed in the\nprior commit; its regression input ships as a seed.",
"is_bot": false,
"headline": "Add the adversarial negative suite",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-13T03:45:33Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fb64f47b4f48749186475666ada51d9c0da16d0f",
"body": "Sanitize applied its rules once and truncated last. The truncation\nmarker \"[REDACTED:truncated]\" introduces a word boundary the original\ntext did not have, so a rule could match on a second pass what it could\nnot on the first — a hex run longer than maxLen, broken past the cut by\na non-hex word char\n[…]\nsee text a caller already sanitized.\nConvergence is 1-3 passes (tags never re-match a rule); the pass count\nis bounded only as a guard. A named regression test pins the exact\ntruncation-boundary case.",
"is_bot": false,
"headline": "Make the sanitizer idempotent under truncation",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-12T18:00:28Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "279407c11601278b597968b9dff927289cb55c97",
"body": "redact is the boundary-level complement to Secret: where Secret makes a\nheld value self-redacting, redact scrubs free-form text that has already\nbeen assembled — a log line, an error string — masking credential-shaped\nsubstrings and neutralizing CWE-117 log injection (CRLF, ANSI, shell\nmetacharacter\n[…]\nrget.\nTests drive the real sinks: a live slog text logger for message, string,\nerror, grouped, WithAttrs, and LogValuer paths, plus idempotence,\ntruncation, and the provider-rules-are-opt-in contract.",
"is_bot": false,
"headline": "Add the redact subpackage for boundary-level log scrubbing",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-12T18:00:28Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4619347306fae97741a4f38882b6e7bd48a1f70c",
"body": "HardenProcess was Linux-only, returning HardenNone everywhere else, and\nDESIGN's DisableCoreDumps / SetMemlockLimit helpers were unimplemented.\nThis lands all three across the platforms that have the primitives.\n\nHardenProcess on Windows now applies two irreversible mitigation\npolicies via SetProces\n[…]\n tested out-of-process in re-exec'd children so they don't poison the\nparallel suite; SetMemlockLimit's never-lower contract is tested\nin-process. Verified on Windows natively and on Linux under WSL2.",
"is_bot": false,
"headline": "Make process hardening cross-platform; add the rlimit helpers",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-12T18:00:28Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9de39782b13dfead38e4e35c146f4631a851d537",
"body": "While sealed, pages are PAGE_NOACCESS — in-process reads already\nfault. What page protection cannot stop is a full process memory dump:\nprocdump, Task Manager, WER full dumps, and the hibernation file read\nthrough the kernel and ignore protection bits, so a dormant sealed\nsecret appeared in every du\n[…]\ned buffer\nmust not false-report a canary violation, and a real overflow\ninflicted before sealing must still be detected after a full cipher\ncycle — the cipher raises the dump bar without masking bugs.",
"is_bot": false,
"headline": "Encrypt sealed buffers with a kernel-held key on Windows",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-12T18:00:28Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "27581e93a8a36df52380eef3c93bd7a7fe3ad6d6",
"body": "Two Linux features can duplicate secret bytes onto physical frames\noutside our wipe's reach, and both are one madvise away from off:\n\nkhugepaged collapses anonymous pages into a transparent hugepage by\nCOPYING them to new frames and freeing the originals unwiped — a\nkernel-made copy of the secret th\n[…]\n threat being disabled does\nnot exist. The proof test does not trust the return code — it reads\n/proc/self/smaps and requires the kernel's own \"nh\" VmFlag on the\nsecret VMA (verified live under WSL2).",
"is_bot": false,
"headline": "Deny the kernel's page-copying optimizations on secret memory",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-12T18:00:28Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7c3e152f86af78e0576c4b38a6e765752d5f7418",
"body": "secmem's most security-critical path — memfd_secret mapped MAP_FIXED\ninto a pre-reserved PROT_NONE range — depends on kernel behavior with\nno stability promise beyond the syscall. KERNELS.md records every\nkernel the suite has actually been EXECUTED on, with the three security\nproofs (guard-fault, me\n[…]\n WSL2 kernel,\nsecretmem live, full pass) and 6.18.26 (stock WSL2, secretmem live,\nfull pass). The reproduction recipe is a single self-contained test\nbinary — the target machine needs no Go toolchain.",
"is_bot": false,
"headline": "Start the kernel verification log",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-12T18:00:28Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5b2463ffd5c4acd3b8987aae153c79b61aedd52c",
"body": "Each allocation is now [ guard | secret pages | guard ]: PROT_NONE\nreservations on Linux/Darwin, reserved-uncommitted memory on Windows. A\nlinear over/under-flow that reaches a guard faults instead of silently\ntouching whatever the kernel placed next to the secret. The page-\nrounding slack behind th\n[…]\nallback, which has no address space to bracket. The\nwhole suite is race-clean (first -race run of this project) and the\nfull Linux suite, including the live memfd_secret path, passes on a\nreal kernel.",
"is_bot": false,
"headline": "Bracket every secret with guard pages and canaries",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-12T18:00:28Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "89ad50baa7aab468c3aae6965229f5ece07dc331",
"body": "Secret wraps a SecureBuffer as a value safe to embed in structs that\nget logged, formatted, or marshalled. The redaction methods are\nimplemented, not omitted — fmt and encoding/json reflect into struct\nfields, so a type without String/GoString/MarshalText/MarshalJSON/\nLogValue leaks the moment someo\n[…]\nstill works, nothing panics. Tests drive the\nreal sinks — fmt verbs on values, pointers, and struct fields,\njson.Marshal, and a live slog logger — asserting the plaintext never\nappears in any of them.",
"is_bot": false,
"headline": "Add Secret, the leak-safe value type",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-12T18:00:27Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "34e93c355ef4a21d31346e4c46f2ab5a56518863",
"body": "The package docs promise that a platform with no lockable off-heap\nmemory \"fails loudly rather than degrading to unprotected heap\nstorage.\" Until now that was a lie: the stub silently make([]byte)'d\nand returned nil — the exact footgun this library is positioned\nagainst. Now it is true.\n\nConstructor\n[…]\nlatform; each mlock_*.go declares its platformHasSecureMemory const.\nThe stub-tagged tests pin fail-closed and opt-in behavior; they compile\nunder GOOS=freebsd vet but need a stub platform to execute.",
"is_bot": false,
"headline": "Fail closed on platforms without secure memory",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-12T18:00:27Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "21c7df8a51ac8c36c16a1761c37a0a786b1d4d57",
"body": "The package docs promise \"use Probe at startup\" and per-buffer\nCapabilities; this commit makes both true, per DESIGN §6.\n\nThe allocators stop swallowing what they did. allocSecretMem and\nallocMapAnon on all four platforms now return an allocInfo recording\nwhich protections the allocation actually re\n[…]\nfrom a per-arch archWipeGuaranteed const (asm +\ncache flush on amd64/arm64, constant-time store elsewhere);\nRegisterScrub from RuntimeSecretActive(); GuardPages is always false\nuntil guard pages land.",
"is_bot": false,
"headline": "Add honest capability reporting: Capabilities, Probe, Warnings",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-12T18:00:27Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "87b98ea4a51d7ec5545322331327bbaf40f5ec96",
"body": "Same lens as the Scrub rename, applied to the rest of the surface.\n\nSecureBuffer.Read/Write become CopyOut/CopyIn. They borrowed the two\nmost loaded names in Go's I/O vocabulary while honoring neither\ncontract: not Reader/Writer (wrong shape), not ReaderAt/WriterAt\n(partial copies, never a short-rea\n[…]\nstructors, the Harden bitmask, the buffer and\narena verbs, the runtime/secret posture family, and the ErrDestroyed /\nErrArenaDestroyed asymmetry (the unprefixed one is the package's\ngeneral sentinel).",
"is_bot": false,
"headline": "Rename for honesty: copies, comparisons, slots, frame files",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-12T18:00:27Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8ea1ccf573002e3f562b782b510ce3d27b18f2b0",
"body": "WipeBytes and WipeArray had no callers — not in the library, not in the\ntests beyond their own. WipeArray took a slice, not an array, so the\nname was factually wrong, and its whole body was WipeBytes(b). Worse,\nboth lived in the legacy file set, so the public API changed shape by\nbuild: present on W\n[…]\n positioned it as canonical.\nThe orphaned wipeBytes assembly and its constant-time generic twin go\nwith the exports; the only thing left in the legacy files is the 32 KiB\nframe wipe that Scrub defers.",
"is_bot": false,
"headline": "Delete the redundant exported wipes",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-12T18:00:27Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "19e6f643b91667773ddc5f92454e26f81fee50bb",
"body": "SecretDo named the implementation, not the abstraction — and the\nimplementation it named (runtime/secret.Do) is absent on every platform\nbut linux/amd64|arm64, exactly where the best-effort fallback matters\nmost. It also shared a prefix with the Secret value type while having\nnothing to do with it, \n[…]\n the scrub name.\nThe runtime/secret experiment surface (RuntimeSecretActive,\nAssertRuntimeSecret, ErrRuntimeSecretInactive) keeps its name, since it\ndescribes the experiment posture, not the function.",
"is_bot": false,
"headline": "Rename SecretDo to Scrub",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-12T18:00:27Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f0699cd688840ce0042c7317c61d988a4bc25b1b",
"body": "The 32 KiB frame wipe SecretDo defers on the legacy path allocates its\nown stack frame to zero. On a shallow call tree that allocation triggers\nmorestack: the goroutine's stack is copied to a larger segment, so the\nsingle deferred wipe ran on the RELOCATED stack — zeroing the fresh copy\nwhile fn's r\n[…]\n a uintptr held across calls — the only way to observe\nresidual stack in Go — drawing a documented vet unsafeptr report on\nlegacy-amd64, suppressed inline now and via .golangci.yml at the lint commit.",
"is_bot": false,
"headline": "Fix the legacy frame scrub's shallow-stack miss",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-12T18:00:27Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5bc9aacceed3862f00f3e4905440bf2fcd09864b",
"body": "WithBytesHardened, WithBytesHardenedErr, SecureContext, PanicError, and\nthe 2 KiB scratch-frame wipe had no callers — not in the library, not in\nthe consumers, not in the design. The June security amendments replaced\nthe cluster with SecretDo and wired all the production secret paths to\nthat; this w\n[…]\nability hole of its own — it silently misses when the goroutine\nstack is shallow — which the next commit fixes; the 2 KiB variant\ndeleted here was not the fix, just a smaller wipe welded to dead code.",
"is_bot": false,
"headline": "Delete the dead legacy-hardened wrapper cluster",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-12T18:00:26Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "babe26e7b4d7f1b7ac6013b39f38364ae2c64510",
"body": "The borrowing accessors called fn without checking it, so a nil callback\npanicked inside library frames — which the no-panic rule forbids. Guard\nthe eight of them (WithBytes/WithBytesErr on both the buffer and the\narena slot, Scope, ScopeWith, and the two hardened wrappers): a nil fn\nnow comes back \n[…]\n receiver already does.\nScopeWith checks its ctor too.\n\nThe scrub primitives (SecretDo, SecureContext) have the same hole. They,\nand whether SecureContext should be exported at all, are the next pass.",
"is_bot": false,
"headline": "Return an error, not a panic, on a nil callback",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-12T18:00:26Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8d0a891e9bf81fe37cde6ccbc41c2eabbd3c9fde",
"body": "Wrong shape and wrong name. It borrowed the With* prefix from the byte\naccessors, but those give you a view that dies with the closure — this\ngives you a heap copy you're meant to keep. It was also a free function\nwhere every other accessor is a method, took a purpose label nobody ever\npassed, and n\n[…]\n on runtimesecret builds the GC erases\nit once nothing references it — best effort, not a promise. Tests pin\nthe load-bearing part: the returned string still reads right after the\nbuffer is destroyed.",
"is_bot": false,
"headline": "Replace UseAsString with ExposeString",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-12T18:00:26Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4a60c62ef4b69c533f4ead232cae0f287bf4f388",
"body": "Rename the package from security to secmem everywhere the old name\nleaked: log and error messages, doc-comment examples, per-file headers.\nGive the error sentinels a secmem: prefix, and drop the two keyring\nsentinels that rode along in errors.go — they belong to code that\ndidn't come with us.\n\nColla\n[…]\nverview instead of nine, and rewrite the leftover internal references\n(a predecessor type name, review tags, a roadmap phase) into prose that\nstands on its own.\n\nRename and docs only, no logic change.",
"is_bot": false,
"headline": "Scrub the internal branding and tidy the docs",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-12T18:00:26Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a268776477ab358046afdff9e4892a5df4e72dbf",
"body": "The off-heap buffer and everything it can't compile without:\nSecureBuffer, the arena, the buffer lock, the wipe asm, the\nmlock/VirtualLock allocators, process hardening, the runtime/secret\nscrub (with the legacy frame-scrub fallback for platforms that lack it),\nand the crash-wipe registry. Tests com\n[…]\nmap'd pages, locked out of swap, wiped on destroy, and\nyou only touch them inside a closure. No raw-slice accessor.\n\nOnly dependency is x/sys. Builds on linux/darwin/windows x amd64/arm64,\ntests pass.",
"is_bot": false,
"headline": "Bring in the SecureBuffer core",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-12T18:00:26Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "cfd374fb6dae536f9e79628719899d90dfc05a3d",
"body": "Stand up the repository skeleton for the pure-Go secmem library:\n\n- go.mod: module github.com/deadpoets/secmem, go 1.26 (no requires yet;\n x/sys is added with the first code that imports it)\n- LICENSE: Apache-2.0\n- doc.go: package overview and lifecycle\n- Repo hygiene: .gitattributes (LF normalization), .editorconfig,\n .gitignore, and a Makefile (test/fmt/vet/lint/vuln/fuzz/cover/tidy)",
"is_bot": false,
"headline": "Scaffold the secmem core module",
"author_name": "Chris Fink",
"author_login": "deadpoets",
"committed_at": "2026-07-12T18:00:26Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 2,
"commits_last_year": 69,
"latest_release_at": "2026-07-20T00:43:23Z",
"latest_release_tag": "v0.2.0",
"releases_from_tags": true,
"days_since_last_push": 2,
"active_weeks_last_year": 2,
"days_since_latest_release": 3,
"mean_days_between_releases": 3
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 100,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": true
},
"ecosystem": {
"packages": [
{
"name": "github.com/deadpoets/secmem",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": true,
"registry_url": "https://pkg.go.dev/github.com/deadpoets/secmem",
"is_deprecated": false,
"latest_version": "v0.2.0",
"repository_url": "https://github.com/deadpoets/secmem",
"versions_count": 2,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-20T00:43:23Z",
"latest_version_yanked": null,
"days_since_latest_publish": 3
},
{
"name": "github.com/deadpoets/secmem/secmem-lint",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": true,
"registry_url": "https://pkg.go.dev/github.com/deadpoets/secmem/secmem-lint",
"is_deprecated": false,
"latest_version": "v0.1.0",
"repository_url": "https://github.com/deadpoets/secmem",
"versions_count": 1,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-14T22:45:04Z",
"latest_version_yanked": null,
"days_since_latest_publish": 8
},
{
"name": "github.com/deadpoets/secmem/secmem-crypto",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": true,
"registry_url": "https://pkg.go.dev/github.com/deadpoets/secmem/secmem-crypto",
"is_deprecated": false,
"latest_version": "v0.2.0",
"repository_url": "https://github.com/deadpoets/secmem",
"versions_count": 2,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-21T00:56:08Z",
"latest_version_yanked": null,
"days_since_latest_publish": 2
}
]
},
"popularity": {
"forks": 0,
"stars": 1,
"watchers": 0,
"fork_history": {
"days": [],
"complete": true,
"collected": 0,
"total_forks": 0
},
"star_history": null,
"open_issues_and_prs": 1
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [
"examples"
],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [
"Makefile"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"examples/go.mod",
"go.mod",
"secmem-crypto/go.mod",
"secmem-lint/go.mod"
],
"largest_source_bytes": 22634,
"source_files_sampled": 148,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"examples/go.mod",
"go.mod",
"secmem-crypto/go.mod",
"secmem-lint/go.mod"
],
"advisories": {
"error": null,
"scope": "repository_graph",
"source": "osv",
"findings": [
{
"name": "golang.org/x/crypto",
"direct": true,
"version": "v0.54.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5932"
],
"fixed_version": null,
"advisory_count": 1,
"oldest_advisory_days": 15
}
],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {
"unknown": 1
},
"advisory_count": 1,
"affected_count": 1,
"assessed_count": 7,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 1
},
"ecosystems": [
"go"
],
"dependencies": [
{
"name": "golang.org/x/sys",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.47.0"
},
{
"name": "filippo.io/edwards25519",
"manifest": "secmem-crypto/go.mod",
"ecosystem": "go",
"version_constraint": "v1.2.0"
},
{
"name": "github.com/deadpoets/secmem",
"manifest": "secmem-crypto/go.mod",
"ecosystem": "go",
"version_constraint": "v0.2.0"
},
{
"name": "golang.org/x/crypto",
"manifest": "secmem-crypto/go.mod",
"ecosystem": "go",
"version_constraint": "v0.54.0"
},
{
"name": "golang.org/x/tools",
"manifest": "secmem-lint/go.mod",
"ecosystem": "go",
"version_constraint": "v0.48.0"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "filippo.io/edwards25519",
"direct": true,
"version": "v1.2.0",
"ecosystem": "go"
},
{
"name": "github.com/deadpoets/secmem",
"direct": true,
"version": "v0.2.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/crypto",
"direct": true,
"version": "v0.54.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/sys",
"direct": true,
"version": "v0.47.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/tools",
"direct": true,
"version": "v0.48.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/mod",
"direct": false,
"version": "v0.38.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/sync",
"direct": false,
"version": "v0.22.0",
"ecosystem": "go"
}
],
"collected": true,
"truncated": false,
"total_count": 7,
"direct_count": 5,
"indirect_count": 2
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 38,
"open_issues": 1,
"closed_ratio": 0,
"closed_issues": 0,
"closed_unmerged_prs": 1
},
"bus_factor": 1,
"bot_contributors": 1,
"top_contributors": [
{
"type": "User",
"login": "deadpoets",
"commits": 63,
"avatar_url": "https://avatars.githubusercontent.com/u/7587613?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml",
"fuzz.yml"
],
"has_docs_dir": false,
"linter_configs": [
".golangci.yml"
],
"has_editorconfig": true,
"has_linter_config": true,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 8,
"reason": "branch protection is not maximal on development and all release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/29 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 0,
"reason": "project has 0 contributing companies or organizations -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 10,
"reason": "project is fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 8,
"reason": "dependency not pinned by hash detected -- score normalized to 8",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 10,
"reason": "security policy file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 10,
"reason": "GitHub workflow tokens follow principle of least privilege",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 9,
"reason": "1 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "f006acc0001ce27ba6b1462d66510595b962f5f8",
"ran_at": "2026-07-23T08:23:31Z",
"aggregate_score": 6.9,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": true,
"has_dependabot_config": true
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-23T08:17:06Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-07-21T00:56:08Z",
"ci_last_conclusion": "FAILURE",
"oldest_open_issues": [
{
"number": 32,
"created_at": "2026-07-18T16:01:30Z",
"last_comment_at": null,
"last_comment_author": null
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/deadpoets/secmem",
"host": "github.com",
"name": "secmem",
"owner": "deadpoets"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 59,
"inputs": {
"security": 74,
"vitality": 68,
"community": 43,
"governance": 41,
"engineering": 74
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "moderate",
"name": "Vitality",
"value": 68,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 54,
"inputs": {
"commits_last_year": 69,
"human_commit_share": 0.913,
"days_since_last_push": 2,
"active_weeks_last_year": 2
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 2 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 2
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "2/52 weeks with commits",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 2
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "69 commits in the last year",
"points": 16.6,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 69
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 88,
"inputs": {
"releases_count": 2,
"latest_release_tag": "v0.2.0",
"releases_from_tags": true,
"days_since_latest_release": 3,
"mean_days_between_releases": 3
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "2 version tags (no GitHub releases)",
"points": 16.2,
"status": "partial",
"details": [
{
"code": "version_tags_no_releases",
"params": {
"count": 2
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 3 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 3
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~3 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 3
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 43,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 1,
"inputs": {
"forks": 0,
"stars": 1,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "1 stars",
"points": 0,
"status": "missed",
"details": [
{
"code": "stars",
"params": {
"count": 1
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "0 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 0
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "excellent",
"name": "Community health",
"note": null,
"notes": [],
"value": 92,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (Apache-2.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "Apache-2.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 13.5,
"status": "met",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 6.3,
"status": "met",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "at_risk",
"name": "Sustainability & Governance",
"value": 41,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 10,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "at_risk",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 37,
"inputs": {
"merged_prs": 38,
"open_issues": 1,
"closed_issues": 0,
"issue_closed_ratio": 0,
"closed_unmerged_prs": 1
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "0% of issues closed",
"points": 0,
"status": "missed",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 0
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "38/39 decided PRs merged",
"points": 37.3,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 38,
"decided": 39
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/29 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 42,
"inputs": {
"followers": 1,
"owner_type": "User",
"is_verified": null,
"owner_login": "deadpoets",
"public_repos": 20,
"account_age_days": 4452
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "1 followers of deadpoets",
"points": 2.2,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 1,
"login": "deadpoets"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "20 public repos, account ~12 yr old",
"points": 21.6,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 20
}
},
{
"code": "account_age_years",
"params": {
"years": 12
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 92,
"inputs": {
"packages": [
"github.com/deadpoets/secmem",
"github.com/deadpoets/secmem/secmem-lint",
"github.com/deadpoets/secmem/secmem-crypto"
],
"ecosystems": "go",
"any_deprecated": false,
"min_days_since_publish": 2
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "3 package(s) on go",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 3,
"ecosystems": "go"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 2 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 2
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "2 published versions",
"points": 12,
"status": "partial",
"details": [
{
"code": "published_versions",
"params": {
"count": 2
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 74,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "excellent",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": true,
"has_linter_config": true,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "2 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 2
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": ".golangci.yml",
"points": 16,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yml"
}
}
],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 6.4,
"status": "met",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"topics": [
"cryptography",
"go",
"golang",
"hardening",
"key-management",
"memory-safety",
"mlock",
"secret-management",
"secrets",
"secure-memory",
"security",
"memfd-secret"
],
"has_wiki": false,
"homepage": null,
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "12 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 12
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "good",
"name": "Security",
"value": 74,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "good",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Packaging, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"packaging",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 70,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 16,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 2,
"scorecard_aggregate": 6.9
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection is not maximal on development and all release branches",
"points": 6,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/29 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is fuzzed",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 8",
"points": 4,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "GitHub workflow tokens follow principle of least privilege",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "1 existing vulnerabilities detected",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories. Remaining weights renormalized. Matched 7 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"indirect_dependencies_free_of_known_advisories"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_repository",
"params": {
"assessed": 7
}
},
{
"code": "advisories_repo_graph_caveat",
"params": {}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 89,
"inputs": {
"source": "osv",
"advisories": 1,
"affected_packages": 1,
"assessed_packages": 7,
"unassessed_packages": 0,
"affected_by_severity": "unknown 1",
"direct_affected_packages": 1
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "1 affected: golang.org/x/crypto v0.54.0 (unknown)",
"points": 26.6,
"status": "partial",
"details": [
{
"code": "advisories_affected",
"params": {
"count": 1,
"packages": "golang.org/x/crypto v0.54.0 (unknown)"
}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "transitive set not separable from development and test dependencies in this scope",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_scope_not_separable",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory has been public longer than 90 days",
"points": 40,
"status": "met",
"details": [
{
"code": "advisories_none_stale",
"params": {
"days": 90
}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 7,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 2
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 68,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 1,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "63 of 63 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 63,
"sampled": 63
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "excellent",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 88,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [
"Makefile"
],
"has_devcontainer": false,
"has_linter_config": true,
"typecheck_configs": [],
"agent_commit_share": 0,
"toolchain_manifests": [
"examples/go.mod",
"go.mod",
"secmem-crypto/go.mod",
"secmem-lint/go.mod"
],
"dependency_bot_commit_share": 0.087
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": ".golangci.yml",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yml"
}
}
],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Go (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 69",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 69
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "6 of the last 69 commits are automated dependency updates",
"points": 8,
"status": "met",
"details": [
{
"code": "dependency_bot_commits",
"params": {
"count": 6,
"sampled": 69
}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 8",
"points": 8,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 22634,
"source_files_sampled": 148,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/148 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 148,
"oversized": 0
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "at_risk",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"example_dirs": [
"examples"
],
"has_mcp_signal": false,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": "examples",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "examples"
}
}
],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
],
"report_type": "repository",
"generated_at": "2026-07-23T08:23:45.399020Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/d/deadpoets/secmem.svg",
"full_name": "deadpoets/secmem",
"license_state": "standard",
"license_spdx": "Apache-2.0"
}