Skip to content

Harden repository security configuration - #36

Merged
dtroupe-plaid merged 1 commit into
masterfrom
codex/security-public-readiness
Aug 21, 2026
Merged

Harden repository security configuration#36
dtroupe-plaid merged 1 commit into
masterfrom
codex/security-public-readiness

Conversation

@dtroupe-plaid

@dtroupe-plaid dtroupe-plaid commented Aug 21, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • pin every external GitHub Action reference to a verified full commit SHA while retaining the major version in a comment
  • direct vulnerability reports to the Plaid HackerOne program
  • apply a seven-day Dependabot cooldown to GitHub Actions, Pub, and Gradle version updates

Validation

  • parsed both modified YAML files successfully
  • verified all eight action references use full 40-character commit SHAs
  • verified the legacy Plaid disclosure URL is no longer present
  • ran git diff --check successfully

Dependabot cooldown does not delay security updates.

@dtroupe-plaid
dtroupe-plaid merged commit db24497 into master Aug 21, 2026
3 checks passed
@dtroupe-plaid
dtroupe-plaid deleted the codex/security-public-readiness branch August 21, 2026 21:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@plaid-public-product-security-bot plaid-public-product-security-bot plaid-public-product-security-bot approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@dtroupe-plaid @plaid-public-product-security-bot