1

Author: ahmerhabib

.github/workflows/security-scan.yml

@@ -0,0 +1,23 @@
+name: Security Scan
+
+on:
+  push:
+    branches:
+      - "**"
+  pull_request:
+
+jobs:
+  secret-scan:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Run Gitleaks
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -6,6 +6,22 @@ target/
 # Runtime artifacts
 data/
 
+# Secrets and local credentials
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+*.p12
+*.pfx
+*.jks
+*.keystore
+*.crt
+*.cer
+*.der
+secrets/
+credentials/
+
 # IDE
 .idea/
 .vscode/

SECURITY.md

@@ -0,0 +1,25 @@
+# Security Policy
+
+## Supported Versions
+
+This repository currently supports security fixes on the `main` branch.
+
+## Reporting a Vulnerability
+
+If you discover a security issue, please do **not** open a public issue.
+
+Instead:
+1. Email the maintainer directly (or use GitHub private security reporting if enabled).
+2. Include clear reproduction steps, affected files/paths, and impact.
+3. Share any proof-of-concept in a safe, non-destructive format.
+
+You can expect:
+- Initial acknowledgement within 3 business days.
+- Triage and severity assessment as quickly as possible.
+- Coordinated disclosure once a fix is available.
+
+## Secure Development Notes
+
+- Never commit secrets, tokens, private keys, or `.env` files.
+- Use local environment variables for credentials.
+- Generated build artifacts (`bin/`, `target/`, `*.class`) should stay out of version control.