@gspothq/cli 0.0.0-stage → 0.1.1

package/configurations/general/prose/vale/styles/gspot/link-text.yml

@@ -0,0 +1,8 @@
+extends: existence
+message: "Link text '%s' says nothing. Name the destination."
+level: error
+ignorecase: true
+scope: link
+nonword: true
+tokens:
+    - '^(?:here|this|this page|read more|more|click here|link|documentation|docs)$'

package/configurations/general/prose/vale/styles/gspot/locations.yml

@@ -0,0 +1,14 @@
+extends: existence
+message: "Relative location '%s'. Name the thing, not where it sits."
+level: error
+ignorecase: true
+tokens:
+    - see above
+    - see below
+    - as mentioned above
+    - as noted above
+    - as described below
+    - the following section
+    - the previous section
+    - later in this document
+    - earlier in this document

package/configurations/general/prose/vale/styles/gspot/marketing.yml

@@ -0,0 +1,26 @@
+extends: existence
+message: "Marketing word '%s'."
+level: error
+ignorecase: true
+tokens:
+    - robust
+    - seamless
+    - seamlessly
+    - powerful
+    - easily
+    - simply
+    - elegant
+    - blazing
+    - cutting-edge
+    - state-of-the-art
+    - world-class
+    - best-in-class
+    - enhanced
+    - comprehensive
+    - leverage
+    - leverages
+    - leveraging
+    - streamline
+    - streamlined
+    - effortless
+    - effortlessly

package/configurations/general/prose/vale/styles/gspot/merge-conflict-markers.yml

@@ -0,0 +1,13 @@
+# Adapted from RedHat.MergeConflictMarkers; see ../LICENSES.md.
+extends: existence
+scope: raw
+level: error
+nonword: true
+link: https://redhat-documentation.github.io/vale-at-red-hat/reference-guide.html#merge-conflict-markers
+message: Do not commit Git merge conflict markers in source code.
+action:
+    name: remove
+tokens:
+    - ^<{7}\s.*$
+    - ^={7}$
+    - ^>{7}\s.*$

package/configurations/general/prose/vale/styles/gspot/militaristic-language.yml

@@ -0,0 +1,22 @@
+# Adapted from Microsoft.Militaristic; see ../LICENSES.md.
+extends: substitution
+message: Consider '%s' instead of '%s'.
+link: https://learn.microsoft.com/en-us/style-guide/militaristic-language
+level: suggestion
+ignorecase: true
+action:
+    name: replace
+swap:
+    (?:cyber ?)?kill chain: cyberattack chain
+    defense-in-depth approach: multilayered approach
+    external attack surface: external exposure
+    first line of defense: protection
+    frontline analysts: security analysts
+    locked down: secured
+    adversaries: threat actors
+    adversary: threat actor
+    attackers: cyberattackers
+    attacker: cyberattacker
+    blast radius: impact
+    fortifications: protection
+    frontlines: defense

package/configurations/general/prose/vale/styles/gspot/modals.yml

@@ -0,0 +1,9 @@
+extends: existence
+message: "Modal verb '%s'. State the rule or the fact."
+level: error
+ignorecase: true
+tokens:
+    - should
+    - could
+    - would
+    - might

package/configurations/general/prose/vale/styles/gspot/numbered-units.yml

@@ -0,0 +1,18 @@
+# Adapted from Microsoft.Units; see ../LICENSES.md.
+extends: existence
+message: "Write the number in '%s' as digits."
+link: https://learn.microsoft.com/en-us/style-guide/a-z-word-list-term-collections/term-collections/units-of-measure-terms
+level: error
+ignorecase: true
+raw:
+    - \b(?:one|two|three|four|five|six|seven|eight|nine|ten|eleven|twelve|thirteen|fourteen|fifteen|sixteen|seventeen|eighteen|nineteen|twenty|thirty|forty|fifty|sixty|seventy|eighty|ninety|hundred|thousand|million|billion)\s
+tokens:
+    - (?:centi|milli)?meters
+    - (?:kilo)?grams
+    - (?:kilo)?meters
+    - (?:mega)?pixels
+    - cm
+    - inches
+    - lb
+    - miles
+    - pounds

package/configurations/general/prose/vale/styles/gspot/obvious-fields.yml

@@ -0,0 +1,14 @@
+# Adapted from RedHat.ObviousTerms; see ../LICENSES.md.
+extends: existence
+level: suggestion
+message: Consider not documenting %s because it is self-explanatory.
+scope: sentence
+action:
+    name: remove
+tokens:
+    - Description field
+    - Mail field
+    - Name field
+    - Password field
+    - User field
+    - Username field

package/configurations/general/prose/vale/styles/gspot/ordinal-adverbs.yml

@@ -0,0 +1,15 @@
+# Adapted from Microsoft.Ordinal; see ../LICENSES.md.
+extends: existence
+message: 'Do not add -ly to an ordinal number.'
+link: https://learn.microsoft.com/en-us/style-guide/numbers
+level: error
+ignorecase: true
+action:
+    name: edit
+    params:
+        - trim
+        - ly
+tokens:
+    - firstly
+    - secondly
+    - thirdly

package/configurations/general/prose/vale/styles/gspot/percentage-numbers.yml

@@ -0,0 +1,8 @@
+# Adapted from Microsoft.Percentages; see ../LICENSES.md.
+extends: existence
+message: Use a numeral plus the units.
+link: https://learn.microsoft.com/en-us/style-guide/numbers
+nonword: true
+level: error
+tokens:
+    - \b[a-zA-Z]+\spercent\b

package/configurations/general/prose/vale/styles/gspot/placeholders.yml

@@ -0,0 +1,7 @@
+extends: existence
+message: "Placeholder style '%s'. Use <kebab-case> in angle brackets."
+level: error
+nonword: true
+tokens:
+    - "\\bYOUR_[A-Z_]+\\b"
+    - "\\{\\{?[a-z_]+\\}\\}?"

package/configurations/general/prose/vale/styles/gspot/product-centric-writing.yml

@@ -0,0 +1,8 @@
+# Adapted from RedHat.ProductCentricWriting; see ../LICENSES.md.
+extends: existence
+ignorecase: true
+level: suggestion
+link: https://redhat-documentation.github.io/vale-at-red-hat/reference-guide.html#product-centric-writing
+message: "Use a person or a role as the subject, not '%s'."
+tokens:
+    - (allows?|enables?|lets?|permits?)\s(you|customers|the customer|the user|users)

package/configurations/general/prose/vale/styles/gspot/punctuated-headings.yml

@@ -0,0 +1,11 @@
+# Adapted from RedHat.HeadingPunctuation; see ../LICENSES.md.
+extends: existence
+level: warning
+link: https://redhat-documentation.github.io/vale-at-red-hat/reference-guide.html#heading-punctuation
+message: Do not use end punctuation in headings.
+nonword: true
+scope: heading
+action:
+    name: remove
+tokens:
+    - (?<![a-z0-9])\.$|\?$|(?<!\w)!$

package/configurations/general/prose/vale/styles/gspot/self-reference.yml

@@ -0,0 +1,15 @@
+extends: existence
+message: "Self-referential opening '%s'. Start with the subject."
+level: error
+ignorecase: true
+tokens:
+    - this document describes
+    - this guide explains
+    - this file describes
+    - in this document
+    - in this guide
+    - the purpose of this
+    - this topic
+    - this chapter
+    - this section
+    - this subsection

package/configurations/general/prose/vale/styles/gspot/session-identifiers.yml

@@ -0,0 +1,11 @@
+# Adapted from RedHat.SessionId; see ../LICENSES.md.
+extends: existence
+level: error
+ignorecase: true
+scope: raw
+action:
+    name: remove
+message: Do not publish URLs that contain session identifiers. Exposed session IDs enable session hijacking
+    and unauthorized account access.
+tokens:
+    - '[&?](sessionId|seSessionId)=[0-9a-zA-Z-]{8,}'

package/configurations/general/prose/vale/styles/gspot/since.yml

@@ -0,0 +1,6 @@
+extends: existence
+message: "'since' is ambiguous between time and cause. Use 'because' or 'after'."
+level: error
+ignorecase: true
+tokens:
+    - "(?<!@)\\bsince\\b"

package/configurations/general/prose/vale/styles/gspot/straight-quotes.yml

@@ -0,0 +1,11 @@
+# Adapted from RedHat.SmartQuotes; see ../LICENSES.md.
+extends: substitution
+message: Do not use smart quotation marks. Use %s rather than %s.
+level: warning
+nonword: true
+scope: raw
+action:
+    name: replace
+swap:
+    ‘|’: "'"
+    “|”: '"'

package/configurations/general/prose/vale/styles/gspot/suspended-hyphens.yml

@@ -0,0 +1,8 @@
+# Adapted from Microsoft.Suspended; see ../LICENSES.md.
+extends: existence
+message: "Write each compound in full instead of '%s'."
+link: https://learn.microsoft.com/en-us/style-guide/punctuation/dashes-hyphens/hyphens
+ignorecase: true
+level: warning
+tokens:
+    - \w+- and \w+-

package/configurations/general/prose/vale/styles/gspot/symbols.yml

@@ -0,0 +1,8 @@
+extends: existence
+message: "Decorative symbol or emoji '%s'. Use words."
+level: error
+nonword: true
+tokens:
+    - "[\\x{1F300}-\\x{1FAFF}\\x{2600}-\\x{27BF}]"
+    - "\\s(?:\\u2192|\\u2190|\\u21D2)\\s"
+    - "\\u2705|\\u274C|\\u26A0"

package/configurations/general/prose/vale/styles/gspot/time-ranges.yml

@@ -0,0 +1,14 @@
+# Adapted from Microsoft.RangeTime; see ../LICENSES.md.
+extends: existence
+message: Use 'to' instead of a dash in '%s'.
+link: https://learn.microsoft.com/en-us/style-guide/numbers
+nonword: true
+level: error
+action:
+    name: edit
+    params:
+        - regex
+        - '[-–]'
+        - to
+tokens:
+    - \b(?:AM|PM)\s?[-–]\s?.+(?:AM|PM)\b

package/configurations/general/prose/vale/styles/gspot/url-prepositions.yml

@@ -0,0 +1,10 @@
+# Adapted from Microsoft.URLFormat; see ../LICENSES.md.
+extends: substitution
+message: Use 'of' (not 'for') to describe the relationship of the word URL to a resource.
+ignorecase: true
+link: https://learn.microsoft.com/en-us/style-guide/a-z-word-list-term-collections/u/url
+level: suggestion
+action:
+    name: replace
+swap:
+    URL for: URL of

package/configurations/general/prose/vale/styles/gspot/version-range.yml

@@ -0,0 +1,8 @@
+extends: existence
+message: "Version range '%s'. Pin the version the rule applies to, or drop it."
+level: error
+nonword: true
+tokens:
+    - "\\bv?\\d+\\.x\\b"
+    - "\\d+\\+ or (later|newer)"
+    - "(?<!\\bv?\\d+(?:\\.\\d+)*(?:-[\\w.-]+)?(?:\\+[\\w.-]+)?\\s+)\\bor (later|newer|higher)(?![-\\w])"

package/configurations/general/repository/manifest.toml

@@ -0,0 +1,24 @@
+[configuration]
+title = "Repository"
+always_selected = true
+description = "Checks the files that Git tracks and their storage."
+
+[[check]]
+name = "large-files"
+example = "A tracked `notes/big.txt` containing 1,100 KiB exceeds the default 1,024 KiB ceiling and reports `size`. Remove accidental content or store a required large file through Git LFS. Generated and vendored classifications must describe the actual file ownership."
+level = "recommended"
+stage = "commit"
+runs = "once"
+summary = "Checks that every tracked file over the size limit is stored through LFS or declared with a reason."
+why = "A large file in plain git history stays in every clone for good."
+help = "Track the file with git lfs, classify it with gspot set generated `<path>` or gspot set vendored `<path>`, or raise limits.file_kb with a reason."
+
+[[check]]
+name = "tracked-files"
+example = "A tracked .env or node_modules/example/index.js reports tracked-file. Add its path to .gitignore and run git rm --cached on that file, preserving its local contents."
+level = "recommended"
+stage = "commit"
+runs = "once"
+summary = "Checks tracked files against the paths that selected configurations declare untracked."
+why = "Machine-local values and installed packages belong outside shared Git history."
+help = "Add the reported file or folder to .gitignore and remove it from the index with git rm --cached."

package/configurations/general/secrets/gitleaks.toml

@@ -0,0 +1,2 @@
+[extend]
+useDefault = true

package/configurations/general/secrets/manifest.toml

@@ -0,0 +1,125 @@
+
+[configuration]
+title = "Secrets"
+always_selected = true
+description = "Checks environment files and examples, scans staged changes and pushed commits for secrets, and requires reasons for allowed values."
+
+[files]
+paths = ["**"]
+kinds = ["source", "generated", "vendored", "binary"]
+
+[[tool]]
+name = "gitleaks"
+version = "8.30.1"
+min_version = "8.25.0"
+mise = "gitleaks"
+brew = "gitleaks"
+github = { name = "gitleaks/gitleaks", version = "v8.30.1" }
+winget = "Gitleaks.Gitleaks"
+scoop = "gitleaks"
+version_command = ["version"]
+[[tool.replace]]
+file = ".gitleaks.toml"
+shared = false
+
+[[tool.replace]]
+file = "gitleaks.toml"
+shared = false
+
+[[tool]]
+name = "trufflehog"
+crash_pattern = '"level"\s*:\s*"error"'
+version = "3.97.5"
+mise = "trufflehog"
+brew = "trufflehog"
+github = { name = "trufflesecurity/trufflehog", version = "v3.97.5" }
+
+[[tool]]
+name = "dotenv-linter"
+version = "4.0.0"
+mise = "github:dotenv-linter/dotenv-linter"
+brew = "dotenv-linter"
+cargo = "dotenv-linter"
+github = { name = "dotenv-linter/dotenv-linter", version = "v4.0.0" }
+
+[[tool_file]]
+source = "gitleaks.toml"
+target = ".gspot/config/gitleaks.toml"
+tool = "gitleaks"
+
+[[check]]
+name = "gitleaks-staged"
+example = "A staged credential reports a secret finding. Remove the credential from source, load it from the configured environment owner, and stage the fix. If the credential has been exposed, rotate it at its provider."
+level = "recommended"
+stage = "commit"
+runs = "once"
+when = { git = true }
+command = ["gitleaks", "git", "--staged", "--no-banner", "--redact", "--exit-code", "1", "--config", "{tool_file:gitleaks}", "--report-format", "json", "--report-path", "-", "{root}"]
+output = { format = "json", fields = { file = "File", line = "StartLine", column = "StartColumn", rule = "Fingerprint", message = "Description" } }
+summary = "Scans the staged change for keys, tokens, and passwords before the commit exists."
+why = "A secret that reaches a commit stays in history after the line is deleted, and every clone holds it."
+help = "Remove the value and load it from the environment. For a reviewed public value, use gspot ignore with its reported fingerprint and a reason."
+
+[[check]]
+name = "gitleaks-pushed"
+example = "A credential in an earlier commit still reports after it is deleted from the working tree. Rotate the credential and remove it from the affected history, coordinating any rewrite of shared commits. Rerun the history scan."
+level = "recommended"
+stage = "push"
+runs = "history"
+when = { git = true }
+tool = "gitleaks"
+output = { format = "json", file_type = "history", fields = { file = "File", line = "StartLine", column = "StartColumn", rule = "Fingerprint", message = "Description" } }
+summary = "Scans every commit about to be pushed for keys, tokens, and passwords."
+why = "A commit made past the hook still reaches the shared branch unless the push checks it."
+help = "Rewrite the commit that holds the value and rotate the secret. For a reviewed historical example, use gspot ignore secrets/gitleaks-pushed --rule `<fingerprint>` --reason \"...\"."
+
+[[check]]
+name = "gitleaks-files"
+example = "In a folder with no git, a credential in a source file reports a secret finding. Remove the credential from source and load it from the configured environment owner. If the credential has been exposed, rotate it at its provider."
+level = "recommended"
+stage = "commit"
+runs = "once"
+when = { git = false }
+command = ["gitleaks", "dir", "--no-banner", "--redact", "--exit-code", "1", "--config", "{tool_file:gitleaks}", "--report-format", "json", "--report-path", "-", "."]
+output = { format = "json", fields = { file = "File", line = "StartLine", column = "StartColumn", rule = "Fingerprint", message = "Description" } }
+summary = "Scans every file of a folder that has no git for keys, tokens, and passwords."
+why = "Without git there is no staged change to scan, so the files themselves are the only place a secret can be caught."
+help = "Remove the value and load it from the environment. For a reviewed public value, use gspot ignore with its reported fingerprint and a reason."
+
+[[check]]
+name = "trufflehog"
+example = "A committed credential that its provider confirms as active reports a verified secret. Revoke or rotate it at the provider and remove it from the affected history."
+level = "recommended"
+stage = "push"
+runs = "history"
+needs = ["network"]
+when = { git = true }
+tool = "trufflehog"
+exit_codes = [183]
+output = { format = "trufflehog", file_type = "history" }
+summary = "Verifies candidate secrets in the pushed commits against the service that issued them."
+why = "A verified secret is live right now, which makes it the finding to act on first."
+help = "Rotate the secret at its provider, then rewrite the commit that holds it."
+
+[[check]]
+name = "dotenv-linter"
+example = "A dotenv file defining the same key twice reports a duplicate entry. Keep the intended assignment and remove the duplicate, preserving secret values outside version control."
+level = "recommended"
+stage = "commit"
+command = ["dotenv-linter", "check", "--plain", "--skip-updates", "{files}"]
+fix = ["dotenv-linter", "fix", "--plain", "--no-backup", "{files}"]
+files = { filenames = [".env", ".dev.vars"], paths = [".env.*", "**/.env.*", ".dev.vars.*", "**/.dev.vars.*"] }
+output = { format = "regex", pattern = "^(?<file>[^:]+):(?<line>\\d+) (?<rule>[A-Za-z]+): (?<message>.*)$" }
+summary = "Checks every tracked environment file: key format, duplicates, quoting, ordering, and trailing spaces."
+why = "A tracked environment file is a template other people copy; a malformed line there is copied into every machine."
+help = "Run gspot check --fix, or fix the line dotenv-linter names."
+
+[[check]]
+name = "env-examples"
+example = "Source code reading `API_URL` while the example environment file omits that key reports a missing example entry. Add `API_URL=` to `.env.example` and document the required value without committing credentials."
+level = "recommended"
+stage = "push"
+runs = "scope"
+summary = "When an example environment file exists, checks static uppercase keys read through process.env, import.meta.env, Bun.env, Deno.env.get, Python os APIs, and declared reader functions in JavaScript, TypeScript, Python, and component files."
+why = "A variable missing from the example file is the one a new machine lacks on its first run."
+help = "Add the key to the example file (.env.example or the files under secrets.env_examples), or stop reading it."

package/configurations/general/secrets/rules/SECRETS.md

@@ -0,0 +1,13 @@
+# Secrets
+
+- Never hardcode API keys, tokens, passwords, or secrets anywhere in the codebase.
+- Read secrets from the environment or a secret store in one configuration module. A secret has
+  no fallback or default value.
+- Never pass a secret in a command-line flag; other processes can read the process arguments.
+- Builds copy public build-time variables such as `NEXT_PUBLIC_*` and `VITE_*` into the bundle. They hold
+  nothing secret.
+- Examples, documentation, templates, and sample files hold placeholders, never real secrets.
+- Keep actual local overrides in an ignored file.
+- Never log secrets, tokens, passwords, cookies, authorization headers, or connection strings.
+- A published package lists its files explicitly; an ignored file can still leak through the
+  defaults of a packaging tool.

package/configurations/general/security/manifest.toml

@@ -0,0 +1,77 @@
+allowed_words = ["Semgrep", "CodeQL"]
+[configuration]
+title = "Security"
+always_selected = true
+description = "Static analysis for security patterns with Semgrep over every file a selected language claims, and CodeQL for configured project languages."
+
+[files]
+languages = true
+extensions = [".plist"]
+
+[[tool]]
+name = "semgrep"
+version_command = ["--disable-version-check", "--version"]
+suppression = { marker = "\\bnosemgrep\\b", reason = "reason: (?<reason>\\S.*)", forbidden = true }
+version = "1.178.0"
+min_version = "1.100.0"
+pypi = "semgrep"
+mise = "pipx:semgrep"
+brew = "semgrep"
+builds = ["macos", "linux"]
+[[tool.replace]]
+file = ".semgrepignore"
+shared = false
+
+[[tool]]
+name = "codeql"
+version = "2.24.3"
+brew = "codeql"
+github = { name = "github/codeql-cli-binaries", version = "v2.24.3" }
+# The CLI ships for x64 Linux only; its bundled Java does not run on arm64.
+builds = ["macos", "linux-x64", "windows"]
+# Query versions paired with github/codeql tag codeql-cli/v2.24.3.
+query_packs = { actions = "0.6.21", cpp = "1.5.12", csharp = "1.6.3", go = "1.5.7", java = "1.10.8", javascript = "2.3.3", python = "1.7.8", ruby = "1.5.8", rust = "0.1.28", swift = "1.2.17" }
+
+[[tool_file]]
+target = ".semgrepignore"
+tool = "semgrep"
+per_scope = true
+
+[[check]]
+name = "semgrep"
+example = "Code matching a selected local Semgrep rule reports that rule ID and source location. For a rule banning dynamic evaluation, replace `eval(userInput)` with explicit parsing and permitted operations, then rerun the same rule set."
+level = "recommended"
+stage = "push"
+exit_codes = [1, 3]
+command = ["semgrep", "scan", "--strict", "--error", "--metrics", "off", "--disable-version-check", "--no-rewrite-rule-ids", "--quiet", "--json", "{files}"]
+output = { format = "semgrep" }
+summary = "Runs the Semgrep rule packs of the selected configurations, and the repository's own rules, over the changed files."
+why = "An injection or a logged secret reads like ordinary code, and a pattern rule finds it before a reviewer has to."
+help = "Change the code the way the message says. Turn one rule off for a path with gspot ignore security/semgrep --rule `<id>` --paths `<glob>` --reason \"`<why>`\"."
+
+[[check]]
+name = "semgrep-registry"
+example = "Code matching a configured Semgrep registry rule reports its upstream rule ID. Correct the operation identified by that rule and rerun with network access. The configured rule set determines which patterns are findings."
+level = "recommended"
+stage = "manual"
+exit_codes = [1, 3]
+needs = ["network"]
+when = { setting = "tools.semgrep.registry_packs" }
+command = ["semgrep", "scan", "--strict", "{each:--config:tools.semgrep.registry_packs}", "--error", "--metrics", "off", "--disable-version-check", "--quiet", "--json", "{files}"]
+tool = "semgrep"
+output = { format = "semgrep" }
+summary = "Runs the public Semgrep registry packs named in tools.semgrep.registry_packs, which the registry serves over the network."
+why = "The registry packs cover the common vulnerability classes, and their license keeps them out of this package."
+help = "Change the code the way the message says, or turn the rule off for a path with gspot ignore security/semgrep-registry --rule `<id>` --reason \"`<why>`\"."
+
+[[check]]
+name = "codeql"
+example = "A query constructed by concatenating request input into SQL reports a SQL-injection finding when the selected language query pack detects the flow. Use a parameterized database query and rerun with the language build prerequisites satisfied."
+level = "recommended"
+stage = "manual"
+runs = "once"
+tool = "codeql"
+when = { setting = "tools.codeql.languages" }
+summary = "Builds a CodeQL database for every language in tools.codeql.languages and runs the security suite over it."
+why = "Data-flow analysis follows a value from a request to a query across files, which a pattern rule cannot."
+help = "Change the code the result names. Record a false positive with gspot ignore security/codeql --rule `<id>` --paths `<glob>` --reason \"`<why>`\"."

package/configurations/general/security/rules/SECURITY.md

@@ -0,0 +1,55 @@
+# Security
+
+## Input
+
+- Validate every value that enters from outside the program before use: request bodies, query strings,
+  path parameters, headers, cookies, environment, files, provider responses, queue messages,
+  command-line arguments. A type annotation does not validate input.
+- Bound every input: size, length, count, depth, rate.
+- Reject unknown fields in request bodies that create or change data.
+
+## Never build code or paths from input
+
+- No SQL, shell, file path, URL, HTML, regex, dynamic import, or template built by string
+  concatenation with untrusted input. Use parameters, argument arrays, path joins against a fixed
+  root with traversal checks, URL builders, and escaping for the output format.
+- No `eval`, `new Function`, string timers, `exec` with a shell, or reflection driven by input.
+- Deserialize only formats that cannot execute, such as JSON. Do not deserialize pickle or YAML with custom tags.
+
+## Web sinks
+
+- Render untrusted content as text. When the page requires HTML, sanitize it in one module and add a
+  suppression with the reason there.
+- Reject executable script URLs and untrusted inline code.
+- Send security headers: HTTP Strict Transport Security (HSTS), `X-Content-Type-Options: nosniff`, frame policy, referrer policy,
+  and a Content Security Policy that the application's own scripts satisfy.
+
+## Redirects and outbound requests
+
+- Redirect only to a relative path or an allowlisted origin.
+- Outbound fetches to a user-influenced target check the host against an allowlist and reject
+  private, loopback, link-local, and metadata addresses, on every hop of a redirect chain.
+
+## Authentication and authorization
+
+- Identity comes from a verified server-side session or token. A client-supplied user ID, role,
+  or tenant provides data, never authority.
+- Authorize every operation that reads or changes data, through each HTTP, RPC, job,
+  and webhook entry point. Recheck access to the resource even when a parent already checked it.
+- Compare secrets, signatures, and tokens in constant time.
+- Generate tokens, nonces, and reset codes with the platform's cryptographic random source.
+- Hash passwords with a current, slow, salted algorithm through a maintained library. Use one
+  failure message for unknown user and wrong password.
+- Verify webhook signatures against the raw body before decoding, and handle replay with an
+  idempotency key.
+- Cookies that carry sessions: `HttpOnly`, `Secure`, `SameSite`, explicit `Max-Age`, non-default
+  name. Writes never happen on `GET`. A cookie session needs CSRF protection on every
+  state-changing request.
+
+## Builds
+
+- No default credentials, sample admin users, debug endpoints, or auth bypasses in any build.
+
+## Supply chain
+
+- Verify checksums or signatures of downloaded binaries. Never pipe a download into an interpreter.

package/configurations/general/spelling/manifest.toml

@@ -0,0 +1,46 @@
+[configuration]
+title = "Spelling"
+always_selected = true
+description = "typos over every text file, with the words this repository allows and the reason for each."
+
+[files]
+paths = ["**"]
+
+[[tool]]
+name = "typos"
+version = "1.43.5"
+mise = "typos"
+brew = "typos-cli"
+cargo = "typos-cli"
+winget = "crate-ci.typos"
+scoop = "typos"
+github = { name = "crate-ci/typos", version = "v1.43.5" }
+[[tool.replace]]
+file = "typos.toml"
+shared = false
+
+[[tool.replace]]
+file = ".typos.toml"
+shared = false
+
+[[tool.replace]]
+file = "_typos.toml"
+shared = false
+
+[[tool_file]]
+target = ".gspot/config/typos.toml"
+tool = "typos"
+per_scope = true
+
+[[check]]
+name = "typos"
+example = "A misspelled word in selected text reports a spelling finding. Correct it and rerun. Filename findings require a manual rename and reference updates."
+level = "recommended"
+stage = "commit"
+command = ["typos", "--isolated", "--config", "{tool_file:typos}", "--force-exclude", "--format", "json", "--color", "never", "{files}"]
+fix = ["typos", "--isolated", "--config", "{tool_file:typos}", "--force-exclude", "--no-check-filenames", "--write-changes", "--color", "never", "{files}"]
+exit_codes = [2]
+output = { format = "typos" }
+summary = "Finds misspelled words in code, comments, and documentation."
+why = "A typo in an identifier spreads to every caller; in prose it costs the reader a second look."
+help = "Fix the spelling, or write the real name and its reason in the root allowed_words setting."