chore(security): fill the security-contact placeholders (owner-supplied values) - #33
Conversation
…ed values)
Fills the 13 {{PLACEHOLDER}} tokens that kept openssf-compliance red, with
values ruled by the owner on 2026-07-27/28:
SECURITY_EMAIL security@metadatastician.art
PGP_KEY_URL https://metadatastician.art/.well-known/pgp-key.txt
PGP_FINGERPRINT ABF3ECD932C2A04345EC9B3D2E725C6B831EA2B8
(ed25519, created 2026-07-28, expires 2027-07-28,
verified from the owner's exported public key)
WEBSITE metadatastician.art
Judgement calls, recorded:
- The TEMPLATE INSTRUCTIONS comment block is deleted (its own text says to
delete it before publishing, and it contained literal {{...}} tokens that
would keep the gate red).
- The two gpg example commands were keyed on the SECURITY EMAIL; the key's
UID is jonathan@metadatastician.art, so 'gpg --fingerprint security@...'
and '--recipient security@...' would fail. Both now key on the FINGERPRINT,
which works regardless of UID.
- security.txt's optional 'Hiring:' line is dropped rather than filled — no
/careers page exists, and RFC 9116 marks the field optional. Shipping a
dead link helps nobody.
The key itself is being published at the PGP_KEY_URL via the estate-wellknown
Cloudflare worker (which generates /.well-known/security.txt dynamically for
the estate domains); until that deploy lands the URL 404s — the repo files
are correct either way.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
CI failed: CI failed because the newly added '.githooks/' directory at the repository root violates the root shape check allowlist.Overview1 change-related failure found across 1 analyzed log. The root shape validation check rejected the newly introduced FailuresRoot Shape Check Failure (confidence: high)
Summary
Code Review ✅ ApprovedReplaces placeholders in SECURITY.md and security.txt with owner-supplied security contact details to achieve OpenSSF compliance. No issues found.
Tip Comment OptionsAuto-apply is off → Gitar will not commit updates to this branch. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
|
|
|
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
1 participant
Fills all 13
{{PLACEHOLDER}}tokens in.github/SECURITY.md+.well-known/security.txtwith the owner-ruled values (emailsecurity@metadatastician.art, key URL onmetadatastician.art, fingerprintABF3ECD932C2A04345EC9B3D2E725C6B831EA2B8, website). Should turn openssf-compliance green.Three judgement calls, detailed in the commit message: template-instructions block deleted (it says to), gpg examples re-keyed on the fingerprint (the key's UID is
jonathan@, so email-keyed lookups would fail), and the optionalHiring:line dropped (no /careers page — dead link).Key publication itself rides on the
estate-wellknownworker deploy (prepared, awaitingwrangler login).