Skip to content

SCR-395 Security policy and pinned Actions for the Codex plugin list - #43

Open
sahilsunny wants to merge 2 commits into
mainfrom
sahil/scr-395-security-hygiene
Open

sahilsunny wants to merge 2 commits into
mainfrom
sahil/scr-395-security-hygiene

Conversation

@sahilsunny

@sahilsunny sahilsunny commented Nov 12, 2026 •

Copy link
Copy Markdown
Collaborator

What

  • SECURITY.md at the repo root and in plugins/scrapingbee-cli/: how to report a vulnerability, and how API keys are handled.
  • plugins/scrapingbee-cli/.codexignore: keeps .env, logs, caches and scrape output out of the Codex plugin bundle.
  • GitHub Actions pinned to commit SHAs, at the same versions as before (checkout v4.4.0, setup-python v5.6.0, pypi-publish v1.14.3).
  • Two changes so secret scanners stop flagging values that aren't secrets:
    • ENV_API_KEY is typed Final.
    • A test value is renamed to example-key-123.

Verification

  • Unit tests, ruff and ty pass.
  • No unpinned uses: remain in the workflows.

@sahilsunny sahilsunny changed the title SCR-395 Security policy, pinned Actions and dependabot for the Codex plugin list SCR-395 Security policy and pinned Actions for the Codex plugin list Nov 12, 2026
@sahilsunny
sahilsunny requested a review from a team November 13, 2026 09:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant