From 6232e0839537008954a85dd8066b1d06ab8856d4 Mon Sep 17 00:00:00 2001 From: Gerald Fruhmann Date: Sat, 13 Jun 2026 21:49:49 +0200 Subject: [PATCH 1/3] feat!: add public skill references and bump plugin to v3.0.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add reference files for design-public and review-public skills: - scan-checklist.md: full command library for secrets detection (gitleaks/truffleHog patterns), PII regex (AT/DE phone/IBAN/SSN), safe test data replacements, CI/CD hardening checks, .gitignore audit - industry-sources.md: authority-rated source list (OpenSSF, GitHub, CISA, OWASP, SLSA, Sigstore, GitGuardian, NIST, CIS Benchmark) Update plugin metadata and navigation: - plugin.json: v2.0.0 → v3.0.0, 24 → 26 skills - CLAUDE.md: reflect design-public + review-public in skill list - meta-help SKILL.md: menu updated to 26 skills (renumbered 1-26) BREAKING CHANGE: plugin version bumped to v3.0.0 Co-Authored-By: Claude Sonnet 4.6 --- CLAUDE.md | 10 +- plugins/dev/.claude-plugin/plugin.json | 4 +- .../references/industry-sources.md | 68 +++++++ .../references/scan-checklist.md | 174 ++++++++++++++++++ plugins/dev/skills/meta-help/SKILL.md | 28 +-- .../references/industry-sources.md | 7 + .../references/scan-checklist.md | 7 + 7 files changed, 280 insertions(+), 18 deletions(-) create mode 100644 plugins/dev/skills/design-public/references/industry-sources.md create mode 100644 plugins/dev/skills/design-public/references/scan-checklist.md create mode 100644 plugins/dev/skills/review-public/references/industry-sources.md create mode 100644 plugins/dev/skills/review-public/references/scan-checklist.md diff --git a/CLAUDE.md b/CLAUDE.md index 29dd957..d845cb6 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -1,6 +1,6 @@ # Dev Best Practices -This repo contains best-practice rules for software projects (RAG systems, AI agents, data pipelines, full-stack web apps) and a **Claude Code Plugin** with 24 skills. +This repo contains best-practice rules for software projects (RAG systems, AI agents, data pipelines, full-stack web apps) and a **Claude Code Plugin** with 26 skills. ## Repo Structure @@ -10,7 +10,7 @@ This repo contains best-practice rules for software projects (RAG systems, AI ag plugins/dev/ .claude-plugin/ - plugin.json # Plugin metadata (name: "dev", version: "2.0.0") + plugin.json # Plugin metadata (name: "dev", version: "3.0.0") commands/ # Slash command definitions (one file per skill) skills/ # Skill workflow definitions (auto-triggered) rules/ # Mirror of claude/*.md (used by skills as reference) @@ -37,8 +37,10 @@ scripts/ ```text DESIGN: design-app, design-secure, design-api, design-data, design-migration, - design-ux, design-llm, design-observability, design-cicd, design-iac -REVIEW: review-app, review-arch, review-secure, review-ux, review-llm + design-ux, design-llm, design-observability, design-cicd, design-iac, + design-public +REVIEW: review-app, review-arch, review-secure, review-ux, review-llm, + review-public TOOLS: tool-debug, tool-test, tool-style, tool-a11y, tool-perf META: meta-help, meta-install, meta-drift, meta-sync, meta-create-skill ``` diff --git a/plugins/dev/.claude-plugin/plugin.json b/plugins/dev/.claude-plugin/plugin.json index 7c1f18d..e17fb79 100644 --- a/plugins/dev/.claude-plugin/plugin.json +++ b/plugins/dev/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "dev", - "version": "2.0.0", - "description": "24 Skills für Design (inkl. LLM-Engineering/RAG/Agents, Observability/SRE, CI/CD, IaC/GitOps, UX/Human-AI Interaction), Security-Review (ISEC/Stanford/MIT, OWASP LLM Top 10), App-Audit (OWASP ASVS 5.0, DORA), Architektur-Review, Debug, Test, Styling, Accessibility (WCAG 2.2), Performance Engineering (MIT 6.172, USE Method) und Skill-Erstellung.", + "version": "3.0.0", + "description": "26 Skills für Design (inkl. LLM-Engineering/RAG/Agents, Observability/SRE, CI/CD, IaC/GitOps, UX/Human-AI Interaction, Repo-Publication), Security-Review (ISEC/Stanford/MIT, OWASP LLM Top 10), App-Audit (OWASP ASVS 5.0, DORA), Architektur-Review, Debug, Test, Styling, Accessibility (WCAG 2.2), Performance Engineering (MIT 6.172, USE Method) und Skill-Erstellung.", "author": { "name": "Gerald" } } diff --git a/plugins/dev/skills/design-public/references/industry-sources.md b/plugins/dev/skills/design-public/references/industry-sources.md new file mode 100644 index 0000000..2772ad8 --- /dev/null +++ b/plugins/dev/skills/design-public/references/industry-sources.md @@ -0,0 +1,68 @@ +# Industry Sources — Repo Public Scan + +Canonical, authoritative sources for repository publication security. +Academic coverage of this topic is sparse; these industry standards are the +primary knowledge base. + +## Tier 1 — Primary Specifications (highest authority) + +| Source | URL | What it covers | +|---|---|---| +| **OpenSSF Best Practices Badge** | https://bestpractices.coreinfrastructure.org | Full checklist for open source project health: SECURITY.md, signed commits, vulnerability reporting, CI, tests | +| **GitHub Security Hardening Docs** | https://docs.github.com/en/code-security | Platform-specific controls: secret scanning, Dependabot, branch protection, push protection | +| **SLSA Framework v1.0** | https://slsa.dev/spec/v1.0 | Supply chain security levels L1-L3; provenance requirements; build isolation | +| **Sigstore Documentation** | https://docs.sigstore.dev | Keyless signing via Fulcio/Rekor; cosign usage | +| **OpenSSF Scorecard** | https://github.com/ossf/scorecard | Automated scoring: branch protection, pinned deps, CI hardening, signed releases | +| **OpenSSF CVD Guide** | https://github.com/ossf/oss-vulnerability-guide | Coordinated Vulnerability Disclosure for open source; SECURITY.md templates | + +## Tier 2 — Government & Standards Bodies + +| Source | URL | What it covers | +|---|---|---| +| **CISA Security-by-Design** | https://www.cisa.gov/resources-tools/resources/secure-by-design | Hardening principles for software publishers; supply chain recommendations | +| **NIST SSDF SP 800-218** | https://csrc.nist.gov/publications/detail/sp/800-218/final | Secure Software Development Framework; source code management controls | +| **OWASP DevSecOps Guideline** | https://owasp.org/www-project-devsecops-guideline | CI/CD security, SAST/DAST/SCA integration, secrets management | +| **CIS Benchmark for GitHub** | https://www.cisecurity.org/benchmark/github | GitHub settings hardening checklist (requires CIS account) | +| **ENISA — Open Source Software Security** | https://www.enisa.europa.eu/publications/open-source-software-security | EU perspective on OSS supply chain risks | + +## Tier 3 — Industry Reports (data-driven) + +| Source | What it covers | Cadence | +|---|---|---| +| **GitGuardian State of Secrets Sprawl** | Annual statistics on leaked credentials in public repos; detection rates | Annual | +| **Snyk State of Open Source Security** | Vulnerability trends in OSS dependencies; SCA data | Annual | +| **OpenSSF Alpha-Omega Project** | Investments in OSS security; most critical packages | Ongoing | + +## Tool Documentation + +| Tool | URL | Purpose | +|---|---|---| +| **gitleaks** | https://github.com/gitleaks/gitleaks | Secret detection in git history (150+ patterns, entropy) | +| **truffleHog** | https://github.com/trufflesecurity/trufflehog | Secret detection with live credential verification (800+ detectors) | +| **git-filter-repo** | https://github.com/newren/git-filter-repo | History rewriting (recommended over BFG for new projects) | +| **BFG Repo-Cleaner** | https://rtyley.github.io/bfg-repo-cleaner | Fast history rewriting for large repos | +| **pin-github-action** | https://github.com/mheap/pin-github-action | Automate SHA pinning of GitHub Actions | +| **cosign** | https://github.com/sigstore/cosign | Keyless artifact signing via Sigstore | +| **pip-audit** | https://github.com/pypa/pip-audit | Python dependency vulnerability scanning (SCA) | + +## Key Findings from Research (adversarially verified) + +1. **Secret scanning is free + automatic on public GitHub repos** — but only after the repo is already public. Pre-publication scan with gitleaks/truffleHog is essential. + +2. **Deleting from HEAD is not remediation** — git's immutable history preserves the leak in every clone and fork. `git-filter-repo` or BFG required. + +3. **SECURITY.md belongs in root, /docs, or /.github/** — only these locations populate GitHub's Security Policy tab. + +4. **SLSA L2 is achievable with GitHub Actions** — hosted runners + `slsa-framework/slsa-github-generator` provide signed provenance without custom infrastructure. + +5. **Sigstore keyless signing** — ephemeral X.509 certs (10 min TTL) via Fulcio, bound to OIDC identity. No long-lived key management required. + +## License Resources + +| Resource | URL | +|---|---| +| SPDX License List | https://spdx.org/licenses/ | +| choosealicense.com | https://choosealicense.com | +| OSI Approved Licenses | https://opensource.org/licenses | +| EUPL (EU Public License) | https://joinup.ec.europa.eu/collection/eupl | +| License compatibility matrix | https://www.gnu.org/licenses/license-compatibility.html | diff --git a/plugins/dev/skills/design-public/references/scan-checklist.md b/plugins/dev/skills/design-public/references/scan-checklist.md new file mode 100644 index 0000000..d84fac5 --- /dev/null +++ b/plugins/dev/skills/design-public/references/scan-checklist.md @@ -0,0 +1,174 @@ +# Scan Checklist — Commands & Patterns + +## Secrets Detection + +### Tools + +```bash +# gitleaks — full history scan +gitleaks detect --source . --log-opts="--all" \ + --report-format json --report-path gitleaks-report.json + +# truffleHog — live credential verification +trufflehog git file://. --only-verified --json > trufflehog-report.json + +# git native — find files that should never have been committed +git log --all --full-history -- '*.env' '*.pem' '*.key' '*.p12' '*.pfx' \ + '*secret*' '*password*' '*credential*' '*token*' 'id_rsa' 'id_ed25519' +``` + +### Common Secret Patterns (manual grep fallback) + +```bash +# AWS keys +grep -rEn 'AKIA[0-9A-Z]{16}' . + +# Generic API key patterns +grep -rEn '(api_key|apikey|api-key)\s*[=:]\s*["\x27][A-Za-z0-9_\-]{20,}' . --include="*.py,*.ts,*.js,*.yaml,*.yml,*.json" + +# Private key headers +grep -rn 'BEGIN (RSA|EC|OPENSSH|PRIVATE) PRIVATE KEY' . + +# Bearer tokens +grep -rEn 'Bearer\s+[A-Za-z0-9\-._~+/]+=*' . --include="*.py,*.ts,*.js" + +# Password assignments +grep -rEn '(password|passwd|pwd)\s*=\s*["\x27][^"\x27]{6,}["\x27]' . \ + --include="*.py,*.ts,*.js,*.env,*.yaml,*.yml" + +# Database connection strings with credentials +grep -rEn '(mysql|postgres|mongodb|redis):\/\/[^:]+:[^@]+@' . + +# GitHub/GitLab tokens +grep -rEn 'gh[pousr]_[A-Za-z0-9_]{36}|glpat-[A-Za-z0-9\-_]{20}' . +``` + +--- + +## PII Patterns + +### Phone Numbers + +```bash +# AT/DE/CH international +grep -rEn '(\+43|\+49|\+41|0043|0049|0041)[0-9\s\-/()]{7,15}' \ + tests/ fixtures/ data/ seeds/ + +# Generic 10+ digit numbers (catches most international formats) +grep -rEn '\b[0-9]{3,4}[\s\-.]?[0-9]{3,4}[\s\-.]?[0-9]{3,6}\b' \ + tests/ fixtures/ --include="*.json,*.csv,*.sql" +``` + +### Email Addresses + +```bash +# Any email that isn't a known test domain +grep -rEn '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}' \ + tests/ fixtures/ data/ seeds/ | \ + grep -v '@example\.\|@test\.\|@localhost\|@invalid\.' +``` + +### Austrian/German-Specific + +```bash +# IBAN AT/DE +grep -rEn '(AT|DE)[0-9]{2}\s?[0-9]{4}\s?[0-9]{4}\s?[0-9]{4}\s?[0-9]{4}(\s?[0-9]{4})?' \ + tests/ fixtures/ data/ + +# Austrian Sozialversicherungsnummer +grep -rEn '\b[0-9]{3,4}[\s-]?[0-9]{6}\b' tests/ fixtures/ + +# Austrian ZMR-Zahl (Zentrales Melderegister) +grep -rEn '\b[0-9]{12}\b' tests/ fixtures/ + +# Steueridentifikationsnummer +grep -rEn '\b[0-9]{2}-[0-9]{3}/[0-9]{4}\b|\b[0-9]{9}\b' tests/ fixtures/ +``` + +### IP Addresses (non-private) + +```bash +# Public IPs (excludes RFC 1918 private ranges) +grep -rEn '\b(?!10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.|0\.)([0-9]{1,3}\.){3}[0-9]{1,3}\b' \ + tests/ fixtures/ data/ +``` + +--- + +## Safe Test Data Replacements + +| Category | Safe value | Standard | +|---|---|---| +| Phone (AT) | `+43 800 000000` | ÖTK reserved number | +| Phone (DE) | `+49 800 0000000` | BNetzA reserved | +| Email | `test@example.com` | RFC 2606 | +| Email | `noreply@example.org` | RFC 2606 | +| Name (AT/DE) | `Max Mustermann` / `Erika Musterfrau` | Standard Testperson | +| IBAN (AT) | `AT12 3456 7890 1234 5678` | Invalid checksum | +| IBAN (DE) | `DE02 3705 0198 0000 0604 40` | Deutsche Bundesbank test | +| Credit card | `4111 1111 1111 1111` | Visa test (Luhn valid) | +| IP address | `192.0.2.1` – `192.0.2.254` | RFC 5737 TEST-NET-1 | +| IP address | `198.51.100.x` / `203.0.113.x` | RFC 5737 TEST-NET-2/3 | +| Domain | `example.com` / `example.org` / `example.net` | RFC 2606 | +| URL | `https://www.example.com/path` | RFC 2606 | +| UUID | `00000000-0000-0000-0000-000000000001` | Obvious test value | +| Geo coords | `48.2083537, 16.3725042` | Vienna city center (public) | + +--- + +## CI/CD Checks + +### Unpinned Actions + +```bash +# Find version-tag pins (should be SHA pins) +grep -rEn 'uses: [^@]+@v[0-9]' .github/workflows/ +grep -rEn "uses: [^@]+@v[0-9]" .gitlab-ci.yml + +# Example fix: +# actions/checkout@v4 → actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 +# Use: https://github.com/mheap/pin-github-action to automate +``` + +### Missing Permissions + +```bash +# Workflows with no explicit permissions block +grep -rL 'permissions:' .github/workflows/ +# Each result defaults to write-all — reduce to minimum needed +``` + +### Secret Exposure in Logs + +```bash +# Secrets echoed directly +grep -rEn 'echo.*\$\{\{\s*secrets\.' .github/workflows/ + +# Env var with secret that may be logged +grep -rEn -A2 'env:' .github/workflows/ | grep 'secrets\.' +``` + +### Dependency Scanning Presence + +```bash +# Is any SCA tool configured? +grep -rEl 'pip-audit|safety|npm audit|yarn audit|trivy|snyk|dependabot|renovate' \ + .github/workflows/ .github/dependabot.yml 2>/dev/null +``` + +--- + +## .gitignore Coverage Check + +```bash +# Files that should be ignored but aren't +git check-ignore -v .env .env.local .env.production \ + *.pem *.key *.p12 *.pfx id_rsa id_ed25519 \ + node_modules/ __pycache__/ .venv/ venv/ \ + *.log *.sqlite *.db + +# Or check if patterns exist in .gitignore +for pattern in '.env' '*.pem' '*.key' 'node_modules' '__pycache__' '.venv'; do + grep -q "$pattern" .gitignore && echo "✅ $pattern" || echo "❌ MISSING: $pattern" +done +``` diff --git a/plugins/dev/skills/meta-help/SKILL.md b/plugins/dev/skills/meta-help/SKILL.md index 1ca7a77..941b9a6 100644 --- a/plugins/dev/skills/meta-help/SKILL.md +++ b/plugins/dev/skills/meta-help/SKILL.md @@ -34,27 +34,31 @@ Which skill should start? 13 review-secure Security: crypto, injection, memory safety, GDPR/ISO/EU AI Act 14 review-ux UX audit: AI anti-patterns, dark patterns, trust design 15 review-llm LLM audit: architecture, evals, prompt injection, OWASP LLM Top 10 + 16 review-public Repo public scan: secrets in history, PII in tests, governance files, CI/CD hardening + +🏗️ DESIGN (continued) + 17 design-public Publication plan: secrets audit, license, governance docs, branch protection, supply chain 🛠️ TOOLS - 16 tool-debug Stack-aware root cause analysis with fix suggestions - 17 tool-test Write, improve, or plan tests - 18 tool-style CSS / design system + visual basics (color, typography, spacing, loading) - 19 tool-a11y Accessibility audit: WCAG 2.2, screen reader, EU Accessibility Act - 20 tool-perf Performance engineering: USE Method, flamegraph, bottleneck, Bentley Rules + 18 tool-debug Stack-aware root cause analysis with fix suggestions + 19 tool-test Write, improve, or plan tests + 20 tool-style CSS / design system + visual basics (color, typography, spacing, loading) + 21 tool-a11y Accessibility audit: WCAG 2.2, screen reader, EU Accessibility Act + 22 tool-perf Performance engineering: USE Method, flamegraph, bottleneck, Bentley Rules 📁 META - 21 meta-install Add best-practice rules to a project CLAUDE.md - 22 meta-drift Compare project CLAUDE.md against current rule files - 23 meta-sync Keep reference/*.md and claude/*.md in sync - 24 meta-create-skill Build a new skill: research, structure, all files + 23 meta-install Add best-practice rules to a project CLAUDE.md + 24 meta-drift Compare project CLAUDE.md against current rule files + 25 meta-sync Keep reference/*.md and claude/*.md in sync + 26 meta-create-skill Build a new skill: research, structure, all files → Enter a number, or directly describe what you need. ``` ## Step 2 — Start Skill -**With a number:** Start skill immediately. -**With a description:** Choose the best matching skill, mention it briefly ("→ starting review-secure …"), then start directly. +**With a number:** Start skill immediately. +**With a description:** Choose the best matching skill, mention it briefly ("→ starting review-secure …"), then start directly. **With arguments:** Pass to the started skill. Load and follow exactly: `${CLAUDE_PLUGIN_ROOT}/skills//SKILL.md` @@ -62,4 +66,4 @@ Load and follow exactly: `${CLAUDE_PLUGIN_ROOT}/skills//SKILL.md` ## Rules - Show menu immediately, no intro - After the choice: start directly, do not explain or ask again -- Never load all 24 skills at once — always only the chosen one +- Never load all 26 skills at once — always only the chosen one diff --git a/plugins/dev/skills/review-public/references/industry-sources.md b/plugins/dev/skills/review-public/references/industry-sources.md new file mode 100644 index 0000000..bdc8ce4 --- /dev/null +++ b/plugins/dev/skills/review-public/references/industry-sources.md @@ -0,0 +1,7 @@ +# Industry Sources — review-public + +Same source library as design-public. Load from: +`../../../design-public/references/industry-sources.md` + +This file exists as a pointer to avoid duplication. +Both skills draw from the same authoritative sources. diff --git a/plugins/dev/skills/review-public/references/scan-checklist.md b/plugins/dev/skills/review-public/references/scan-checklist.md new file mode 100644 index 0000000..74af2af --- /dev/null +++ b/plugins/dev/skills/review-public/references/scan-checklist.md @@ -0,0 +1,7 @@ +# Scan Checklist — review-public + +Same command library as design-public. Load from: +`../../../design-public/references/scan-checklist.md` + +This file exists as a pointer to avoid duplication. +Both skills share the same scanning commands and PII patterns. From a1763d477a8e25af2753586be884e9118ad5af17 Mon Sep 17 00:00:00 2001 From: Gerald Fruhmann Date: Sat, 13 Jun 2026 21:55:21 +0200 Subject: [PATCH 2/3] fix: replace broken links in industry-sources.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CIS Benchmark URL returned 404, ENISA URL returned 404, GNU license-compatibility page timed out — replaced with working URLs for the same resources. Co-Authored-By: Claude Sonnet 4.6 --- .../dev/skills/design-public/references/industry-sources.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/plugins/dev/skills/design-public/references/industry-sources.md b/plugins/dev/skills/design-public/references/industry-sources.md index 2772ad8..ef50d68 100644 --- a/plugins/dev/skills/design-public/references/industry-sources.md +++ b/plugins/dev/skills/design-public/references/industry-sources.md @@ -22,8 +22,8 @@ primary knowledge base. | **CISA Security-by-Design** | https://www.cisa.gov/resources-tools/resources/secure-by-design | Hardening principles for software publishers; supply chain recommendations | | **NIST SSDF SP 800-218** | https://csrc.nist.gov/publications/detail/sp/800-218/final | Secure Software Development Framework; source code management controls | | **OWASP DevSecOps Guideline** | https://owasp.org/www-project-devsecops-guideline | CI/CD security, SAST/DAST/SCA integration, secrets management | -| **CIS Benchmark for GitHub** | https://www.cisecurity.org/benchmark/github | GitHub settings hardening checklist (requires CIS account) | -| **ENISA — Open Source Software Security** | https://www.enisa.europa.eu/publications/open-source-software-security | EU perspective on OSS supply chain risks | +| **CIS Benchmark for GitHub** | https://www.cisecurity.org/insights/blog/cis-benchmark-for-github | GitHub settings hardening checklist (requires CIS account) | +| **ENISA — Open Source Software Security** | https://www.enisa.europa.eu/topics/cybersecurity-policy/nis-directive-new/open-source-software | EU perspective on OSS supply chain risks | ## Tier 3 — Industry Reports (data-driven) @@ -65,4 +65,4 @@ primary knowledge base. | choosealicense.com | https://choosealicense.com | | OSI Approved Licenses | https://opensource.org/licenses | | EUPL (EU Public License) | https://joinup.ec.europa.eu/collection/eupl | -| License compatibility matrix | https://www.gnu.org/licenses/license-compatibility.html | +| License compatibility matrix | https://www.gnu.org/licenses/license-list.html | From a685a242f6224da1e2b99303a1c32dd416c2bd6f Mon Sep 17 00:00:00 2001 From: Gerald Fruhmann Date: Sat, 13 Jun 2026 22:01:01 +0200 Subject: [PATCH 3/3] fix: replace unstable links in industry-sources.md CIS and ENISA have no stable direct URLs for these resources. GNU license page blocks link checkers with timeouts. Replace with stable homepage URLs + search instructions, and choosealicense.com/appendix for license comparison. Co-Authored-By: Claude Sonnet 4.6 --- .../dev/skills/design-public/references/industry-sources.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/plugins/dev/skills/design-public/references/industry-sources.md b/plugins/dev/skills/design-public/references/industry-sources.md index ef50d68..d54778b 100644 --- a/plugins/dev/skills/design-public/references/industry-sources.md +++ b/plugins/dev/skills/design-public/references/industry-sources.md @@ -22,8 +22,8 @@ primary knowledge base. | **CISA Security-by-Design** | https://www.cisa.gov/resources-tools/resources/secure-by-design | Hardening principles for software publishers; supply chain recommendations | | **NIST SSDF SP 800-218** | https://csrc.nist.gov/publications/detail/sp/800-218/final | Secure Software Development Framework; source code management controls | | **OWASP DevSecOps Guideline** | https://owasp.org/www-project-devsecops-guideline | CI/CD security, SAST/DAST/SCA integration, secrets management | -| **CIS Benchmark for GitHub** | https://www.cisecurity.org/insights/blog/cis-benchmark-for-github | GitHub settings hardening checklist (requires CIS account) | -| **ENISA — Open Source Software Security** | https://www.enisa.europa.eu/topics/cybersecurity-policy/nis-directive-new/open-source-software | EU perspective on OSS supply chain risks | +| **CIS Benchmark for GitHub** | https://www.cisecurity.org/cis-benchmarks | GitHub settings hardening checklist — search "GitHub" on this page (requires free CIS account to download) | +| **ENISA — Open Source Software Security** | https://www.enisa.europa.eu | EU perspective on OSS supply chain risks — search "open source" in ENISA publications | ## Tier 3 — Industry Reports (data-driven) @@ -65,4 +65,4 @@ primary knowledge base. | choosealicense.com | https://choosealicense.com | | OSI Approved Licenses | https://opensource.org/licenses | | EUPL (EU Public License) | https://joinup.ec.europa.eu/collection/eupl | -| License compatibility matrix | https://www.gnu.org/licenses/license-list.html | +| License compatibility matrix | https://choosealicense.com/appendix/ |