Please report security issues privately, not as a public issue or pull request.
Use GitHub private vulnerability reporting, which notifies the maintainer directly and keeps the report confidential until a fix is published.
Expect an acknowledgement within 7 days. This is a personal blog maintained in spare time, so please treat that as a best effort rather than a commitment.
This repository builds and publishes the container image serving zmuda.pro. In scope:
- The site content and Docusaurus configuration under
zmuda-pro/ - The container build (
Dockerfile,default.conf) - The GitHub Actions workflows under
.github/workflows/ - The published image
ghcr.io/theadzik/zmuda-pro-blog
Out of scope: the infrastructure the site runs on (that is a separate, private-by-default homelab), and findings that require an already-compromised maintainer account.
So that reports can skip what is known and already handled:
- Base images are Docker Hardened Images;
every build stage uses
dhi.io/*. - Images are scanned with Trivy (HIGH/CRITICAL, fixable) before they are published; a finding fails the build. The build context is scanned as well, so a vulnerable build-time dependency or a committed secret fails it too.
- Every published image carries a cosign signature, two CycloneDX SBOMs (one for the image, one for the build context) and a SLSA provenance attestation. The build verifies all four before it publishes any tag, and the cluster verifies the signature again at admission before the image is allowed to run.
- All third-party GitHub Actions are pinned by commit SHA.
- Dependencies are updated by Dependabot;
pnpm auditfails a pull request on a high or critical advisory, anddependency-reviewblocks a pull request that would introduce one. - CodeQL scans JavaScript/TypeScript and the Actions workflows themselves.
- Secret scanning with push protection is enabled, backed by a local
detect-secretspre-commit hook.
Only the current release is supported. Fixes ship in the next CalVer release
(YYYY.M.N) rather than being backported.