Security posture

Security posture holds 15 of the standard’s 61 rules. Each one names the evidence that settles it and the skill that fixes it.

1. R-SEC-01Pin every external action and reusable workflow to a full commit SHAoss-hardenGitHub only
2. R-SEC-02Workflows declare least-privilege permissionsoss-hardenGitHub only
3. R-SEC-03Automated dependency updates cover both application dependencies and CI dependenciesoss-hardenGitHub and GitLab
4. R-SEC-04The default branch takes changes only through a change request that passed CI, and rejects force pushesoss-hardenGitHub and GitLab
5. R-SEC-05Release tags are signed and verifiableoss-hardenGitHub and GitLab
6. R-SEC-06A GitLab pipeline pins external execution inputs and restricts inbound job-token accessoss-hardenGitLab only
7. R-SEC-07Untrusted input never reaches a privileged contextoss-hardenGitHub and GitLab
8. R-SEC-08Registry dependencies resolve through a committed lockfileoss-hardenGitHub and GitLab
9. R-SEC-09Static analysis runs on pull requests where the language supports itoss-hardenGitHub and GitLab
10. R-SEC-10Committed secrets are detected before they reach the default branchoss-hardenGitHub and GitLab
11. R-SEC-11Every dependency ecosystem the project ships is watched for known vulnerabilitiesoss-hardenGitHub and GitLab
12. R-SEC-12Where more than one person can merge, the default branch requires an approving reviewoss-hardenGitHub and GitLab
13. R-SEC-13A released tag cannot be moved or deleted, and only trusted principals may create oneoss-hardenGitHub and GitLab
14. R-SEC-14A newly published version waits before the updater proposes itoss-hardenGitHub and GitLab
15. R-SEC-15CI installs dependencies without running the code they shiposs-hardenGitHub and GitLab