penthera 1.7.0 → 1.8.0

package/docs/dashboard.md

@@ -1,187 +0,0 @@
-# The local dashboard: `penthera ui`
-
-`penthera ui` opens one view in your browser for what Penthera knows about
-your projects, laid out like the Claude Code desktop app: projects and runs on
-the left, the selected project or run in the middle, and details on the right.
-It can also run scans and the fix loop for you, stopping at every diff. It runs
-on `127.0.0.1` only, reads only the folders you give it and `~/.penthera`, and
-never contacts the network.
-
-| Dark | Light |
-|---|---|
-| ![Projects, findings, and a finding's detail in the dark theme](../assets/dashboard/ui-dark.jpg) | ![All projects and the side cards in the light theme](../assets/dashboard/ui-light.jpg) |
-
-## Start it
-
-```bash
-penthera ui --open                       # current folder, reports in ./reports
-penthera ui --project ~/code/shop --project ~/code/api --reports ~/code/shop/reports
-penthera ui --demo                       # fake data, nothing read from disk
-```
-
-| Option | Default | What it does |
-|--------|---------|--------------|
-| `--port <n>` | `0` (random free port) | Port on 127.0.0.1 |
-| `--open` | off | Open the one-time URL in your browser |
-| `--project <dir>` | the current folder | A folder the dashboard may read and run in. Repeat for more |
-| `--reports <dir>` | `<first project>/reports` | Where report JSON is read from, and where runs started here write theirs |
-| `--demo` | off | Realistic fake data and a scripted fix loop. For a first look, screenshots and docs |
-
-It prints a URL with a one-time token. Open it once: the token is swapped for
-a session cookie and stops working, so a second browser (or a link that leaked
-into history) gets a 403. Restart `penthera ui` for a new link. Ctrl-C stops
-the server.
-
-## The view
-
-**Left sidebar** (`[` to hide or show). "+ New scan" on top. Then every
-project with its A to F grade, open findings and last scan, with "All
-projects" first; project folders you passed with `--project` show up even
-before their first scan. Below them, recent runs grouped by project, like the
-session list in Claude Code: live runs from this session (a green dot while
-running) and past fix-loop runs from the reports folder. The gear in the
-footer opens settings; the half-moon switches the theme.
-
-**Centre.** One scrolling stream for what you selected:
-
-- a project (or all of them): a compact header with the grade, a severity bar
-  drawn in 1-bit shades, the trend sparkline and open vs fixed; what changed
-  since the last scan (new and fixed); then the findings, "Fix first"
-  (critical and high) before the rest. `/` searches, `j` and `k` move through
-  findings and open each one on the right.
-- a run: its output streams in as a transcript, typed out as it arrives. Each
-  diff of the fix loop appears inline as a small dialog: the recipe, the files,
-  what memory knows about the recipe, the diff, and Apply (`y`), Skip (`n`) or
-  Stop (`q`).
-- a past fix-loop run: rebuilt from its `loopRun` file, round by round, with
-  each fix's decision, result and commit.
-
-At the bottom, a prompt-style bar starts things: **Scan** (with an optional
-URL), **Deps**, **AI tooling** or **Fix loop**, always for the selected
-project's folder. These are plain controls, not a chat: there is no model
-behind them. There is one primary button on screen at a time; while a run is
-going, its dialog owns it and the bar waits.
-
-**Right panel** (`]` to hide or show). Stacked cards, each one collapsible:
-
-| Card | What it shows |
-|---|---|
-| Environment | Offline or online for scans started here (switch it here), the project folder, its git branch and HEAD, and the hosts the last scan contacted (and the ones offline mode blocked) |
-| Memory | Chain status, events, verified and failed fixes, median time to fix, recipe success rates |
-| Dependencies | Package count and ecosystem, the capability diff against your base, typosquats, capabilities in the tree, install firewall decisions |
-| AI tooling | The A to F grade and its history, `penthera.lock` drift, inventory, hidden-content hits |
-| Evidence | Create a bundle from the latest scan, download the auditor, owner or developer report, verify any bundle in one click |
-| Changes | Fixes the loop committed, with their local commits, and the `penthera/fix-*` branches in the folder |
-
-Picking a finding replaces the cards with its detail: "In plain words" (how
-serious, how sure and what that means, what to do, the OWASP mapping), what
-was seen, the evidence, sources, and the exact fix-recipe diff with a button
-that starts the fix loop on that project. `Esc` goes back to the cards.
-
-Below 1180px the right panel becomes a drawer; below 760px the sidebar does
-too. A tap outside closes them.
-
-| Narrow, dark | Narrow, light, a finding open |
-|---|---|
-| <img src="../assets/dashboard/narrow-dark.jpg" alt="The view at 390px, dark" width="280"> | <img src="../assets/dashboard/narrow-light.jpg" alt="A finding in the drawer at 390px, light" width="280"> |
-
-## User stories
-
-| Story | Where it lives |
-|---|---|
-| *As a solo founder before launch, I want to know what to do first when there is no data yet.* | With no reports, the centre shows the wordmark and three steps (scan, dependencies, AI tooling); each focuses the bar on that action. ![First run](../assets/dashboard/ui-start.jpg) |
-| *As a developer who does not live in the terminal, I want to start a scan from the page and watch it work.* | The bar at the bottom; the run streams into the centre and appears in the sidebar. |
-| *As a founder with no security engineer, I want fixes applied only when I approve them.* | The fix loop's inline dialog: Apply, Skip or Stop on every diff; verified fixes land as local commits, failed ones are reverted, nothing is pushed. ![A diff waiting for a decision](../assets/dashboard/ui-run.jpg) |
-| *As a product owner, I want one finding explained in plain words.* | Pick it: the right panel opens with "In plain words", the evidence, sources and the fix diff. |
-| *As a tech lead after a release, I want to see what changed.* | The project header's sparkline, "Since the last scan" (new, fixed), and the runs in the sidebar. |
-| *As the person answering the NIS2 questionnaire, I want evidence an auditor can check.* | The Evidence card: create a bundle, verify it, download the auditor report. |
-| *As a developer reviewing a lockfile bump, I want to see what packages gained.* | The Dependencies card: the capability diff and install firewall decisions. |
-| *As someone who installs skills and MCP servers, I want to know if any hide instructions or drifted.* | The AI tooling card: grade, hidden content, `penthera.lock` drift. |
-| *As someone on a bright screen, I want a light theme.* | The half-moon in the sidebar footer, or Settings; the first visit follows your system. |
-
-## Running things from the page
-
-The bar calls the same functions as the CLI (`executeScan`, `scanDeps`,
-`scanAgents`, `runLoop`) with the same rules. The fix loop needs a clean git
-tree on a branch, works on a local `penthera/fix-<yyyymmdd-hhmm>` branch, runs
-only allow-listed local git commands with hooks off, is always offline with
-egress limited to the URL's host, and never pushes. On top of that:
-
-- The project folder must be inside one of the `--project` folders.
-- A URL that is not on this machine (anything but `localhost`, `127.x.x.x`,
-  `[::1]` and `*.localhost`) needs its hostname typed back before the run
-  starts. Only scan what you own or have written permission to test.
-- One run at a time. Closing the tab does not stop a run; pick it in the
-  sidebar and its transcript replays and continues. Stop finishes the current step, and the fix branch holds only
-  verified commits.
-- Reports land in the reports folder (`loop-<timestamp>.json`,
-  `deps_<timestamp>.json`, and so on), so every screen picks them up.
-
-## Security model
-
-The dashboard is a web server on your machine, so any page open in the same
-browser can send it requests. Every request passes, in this order:
-
-1. **Host check.** The `Host` header must be exactly `127.0.0.1:<port>` or
-   `localhost:<port>`. This blocks DNS rebinding, where `attacker.example`
-   re-resolves to 127.0.0.1 so the attacker's page can read the response. It
-   runs before the token check, so a rebinding page cannot even redeem the
-   link.
-2. **Path check.** No dot segments, encoded dots or slashes, backslashes or NUL
-   bytes. Static files come from an allowlist built at startup; no part of a
-   request path is ever joined onto a filesystem path.
-3. **Session.** The one-time URL token is exchanged for an `HttpOnly;
-   SameSite=Strict` cookie and a redirect to `/`, so the token leaves the
-   address bar. Every request, static files included, needs the cookie.
-   Requests without it are rate-limited (429 with `Retry-After`).
-4. **Origin.** Every `POST` needs an `Origin` equal to the server's own (and
-   `Sec-Fetch-Site: same-origin` when the browser sends it) and a JSON body, so
-   a cross-site form or `fetch` cannot change anything.
-
-Every response carries:
-
-```
-Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self';
-  font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'none'; form-action 'self';
-  frame-ancestors 'none'; require-trusted-types-for 'script'
-X-Frame-Options: DENY            X-Content-Type-Options: nosniff
-Referrer-Policy: no-referrer     Cache-Control: no-store
-Cross-Origin-Opener-Policy / -Resource-Policy / -Embedder-Policy
-```
-
-There are no CORS headers, and `OPTIONS` gets a 405. The page has no inline
-script or style, loads nothing from another host (no CDN, fonts, analytics or
-chart library), and never turns data into HTML: finding titles and evidence
-come from the sites and repos you scanned, so they are only ever set as text.
-Report downloads are served as `text/markdown` attachments from the same
-checks; the audience is one of `auditor`, `owner` or `developer`, nothing else.
-
-Penthera scans its own dashboard clean with `--profile standard`, signed in and
-not; `tests/ui.test.js` runs that scan on every test run, alongside tests for
-the Host check, the token and cookie, Origin, the headers, the rate limit and
-path traversal.
-
-## Design
-
-Calm, terminal-native, and close to the Claude Code desktop app: hairlines
-instead of boxes, one stream in the middle, details on the side. The 1-bit
-register from earlier versions stays in the details: severity as a word plus a
-pattern swatch (solid, hatched, half-tone, dotted, empty), bars drawn with the
-shade characters `█ ▓ ▒ ░`, the pinstriped title bar on the approval dialog,
-and the CLI's `#0000ed` block-letter wordmark on the empty state.
-
-- **One accent.** `#0000ed` marks the primary button, the selected finding,
-  links and chart lines. On black it measures 2.2:1, so there it is only a fill
-  with white on it (9.5:1), a frame or a glow; text in that hue uses `#7a7aff`
-  (6.1:1). On white, `#0000ed` is text-safe (9.3:1). Green is kept for the
-  cursor, the prompt and "OK".
-- **Both themes pass WCAG AA** for every text node in every state (all
-  projects with every card open, a project with a finding open, settings, a
-  past run), measured in the browser, composited.
-- **Motion.** Run output types itself out and the cursor blinks; with
-  `prefers-reduced-motion` both stop and output appears whole. Nothing else
-  animates.
-- **Keyboard.** `/` search, `j`/`k` findings, `[`/`]` side panels, `y`/`n`/`q`
-  answer a diff, `Esc` closes the detail, clears the search or closes a
-  drawer. Every control is a real button or link; the approval dialog takes
-  focus when a diff arrives; screen readers get each log line whole.

package/docs/evidence.md

@@ -1,162 +0,0 @@
-# Evidence bundles and audience reports
-
-Penthera can write the results of one scan as an **evidence bundle**: every
-report, a manifest with the SHA-256 of each file, and an optional SSH
-signature over the manifest. An auditor checks the bundle with one command.
-No hosted service is involved, and nothing needs to be installed beyond Node
-(or `shasum` and `jq`) and OpenSSH 8.0 or later.
-
-## For auditors: verify a bundle
-
-You need the bundle directory and an **allowed signers file** that names the
-key you expect the bundle to be signed with. Get that public key from the
-organisation through a channel other than the bundle itself (their security
-page, an email you can authenticate, or in person).
-
-```bash
-npx penthera evidence verify ./evidence --allowed-signers allowed_signers --require-signature
-```
-
-Exit code `0` means every file matches the manifest and the manifest was signed
-by a key in `allowed_signers`. Exit code `1` means something changed, is
-missing, was added, or the signature does not check out; the output says which.
-
-An `allowed_signers` file is one line per key:
-
-```text
-security@example.com namespaces="penthera-evidence" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA...
-```
-
-### Without Penthera
-
-The bundle does not depend on Penthera to be checked. With standard tools:
-
-```bash
-cd evidence
-# 1. The manifest was signed by the expected key (namespace penthera-evidence)
-ssh-keygen -Y verify -f ../allowed_signers -I security@example.com \
-  -n penthera-evidence -s manifest.json.sig < manifest.json
-# 2. Every artifact matches its hash in the manifest
-jq -r '.artifacts[] | "\(.sha256)  \(.path)"' manifest.json | shasum -a 256 -c -
-# 3. Nothing else is in the directory
-ls
-```
-
-`penthera evidence verify` does the same three checks, and also rejects
-manifest paths that would leave the directory (`../`, absolute paths) and
-symlinked files.
-
-### What the checks prove, and what they do not
-
-- **Hashes** prove that the files have not changed since the manifest was
-  written. Without a signature they prove nothing about who wrote it: anyone
-  can rewrite a file and its hash together.
-- **The signature** proves that the holder of the signing key produced this
-  manifest. It does not prove that the scan was run against the system you
-  care about, or with the options you expect. Read the manifest's `command`,
-  `target`, `scan` and `git` fields, and the auditor report's scope section.
-- A signed bundle only verifies with `--allowed-signers`. Without it,
-  `verify` cannot tell whose key made the signature (anyone can re-sign a
-  rewritten manifest with their own key), so it fails with status
-  `unverified`. A manifest that declares a signature with no `.sig` file
-  fails too.
-- An unsigned bundle passes with an `UNSIGNED` warning. Pass
-  `--require-signature` (with `--allowed-signers`) to make it fail.
-- A scan is a snapshot. The bundle is evidence of what Penthera saw at
-  `generated_at`, not a statement that the system is secure.
-
-## For the team producing evidence
-
-```bash
-penthera https://staging.example.com --repo . --framework nis2 \
-  --evidence evidence/2026-10-19 --sign-key ~/.ssh/id_ed25519
-```
-
-- `--evidence <dir>` writes the bundle. The directory must be new or empty, so
-  a bundle never mixes two runs.
-- `--sign-key <key>` signs `manifest.json` with
-  `ssh-keygen -Y sign -n penthera-evidence`. Use the private key path, or the
-  `.pub` path when the key lives in `ssh-agent` or on a hardware token. A
-  passphrase prompt appears in the terminal.
-- `--sbom <file>` and `--readiness` add their outputs to the bundle.
-- Give auditors the public key out of band, as an `allowed_signers` line.
-
-### What is in a bundle
-
-| File | Contents |
-|------|----------|
-| `report.json` | The full scan result |
-| `report.md` | The default Markdown report |
-| `report.sarif` | SARIF 2.1.0 |
-| `report-developer.md` | Findings with file:line, fix recipe ids or diffs, and sources |
-| `report-owner.md` | Plain-language summary, what to do first, owner actions, trend |
-| `report-auditor.md` | Scope and method, confidence and provenance, egress, inconclusive probes, suppressions, fix timeline, NIS2 and OWASP mapping |
-| `report-custom.md` | Your `--report-template` output, when given |
-| `nis2-readiness.md` | With `--readiness` |
-| `sbom.cdx.json` | CycloneDX SBOM, with `--sbom` |
-| `manifest.json` | Tool version, command line (secrets redacted), timestamp, target, git commit, SHA-256 and size of every file above |
-| `manifest.json.sig` | SSH signature over `manifest.json`, with `--sign-key` |
-
-The command line in the manifest has the values of `--auth-cookie`,
-`--auth-bearer` and any token, secret or password flag replaced with
-`[REDACTED]`, and credentials in URLs masked.
-
-## Audience reports
-
-`--audience developer|owner|auditor` picks who the Markdown report is for. It
-applies to `--markdown <file>`; without `--markdown` the report goes to stdout.
-The default report (no `--audience`) is unchanged.
-
-```bash
-penthera https://example.com --repo . --audience owner > for-the-owner.md
-penthera https://example.com --repo . --audience auditor --markdown audit.md
-```
-
-When a scan used `--memory`, the owner report shows the trend across recent
-scans. When the result has an agent loop run (`loopRun`) or memory has fix
-events, the developer, owner and auditor reports show a fix timeline:
-found → fixed → verified, with time to fix.
-
-## Your own template
-
-`--report-template file.md` renders your own Markdown from the same data the
-audience reports use. The language is deliberately tiny:
-
-```markdown
-# Security status for {{summary.target}}
-
-{{summary.critical}} critical, {{summary.high}} high ({{summary.total}} total).
-
-{{#each findings}}
-- [{{severity}}] {{title}}{{#if location}} at {{location}}{{/if}} ({{confidence}})
-{{/each}}
-
-{{#if suppressed}}
-Set aside: {{#each suppressed}}{{title}} by {{actor}}: {{reason}}; {{/each}}
-{{else}}
-Nothing suppressed.
-{{/if}}
-```
-
-- `{{path.to.value}}` prints a value. Values are HTML- and Markdown-escaped,
-  and newlines become spaces, so a finding title cannot add HTML, a heading, a
-  list item or a table cell.
-- `{{#each list}}…{{/each}}` loops; inside, `{{this}}` is the item and
-  `{{@index}}` its 0-based index. Names not found on the item are looked up in
-  the enclosing scope.
-- `{{#if value}}…{{else}}…{{/if}}`; an empty list counts as false.
-
-There are no helpers, no expressions, no raw output, no partials and no file
-includes. Paths containing `__proto__`, `constructor` or `prototype` are
-rejected, and only own properties are read. A template that uses anything else
-fails with a line number before the scan starts.
-
-Top-level fields: `tool`, `target`, `timestamp`, `duration`, `modes`,
-`profile`, `offline`, `probes`, `summary` (`critical`, `high`, `medium`,
-`low`, `info`, `serious`, `total`, `suppressed`, `inconclusive`), `findings`
-(`fid`, `title`, `severity`, `confidence`, `source`, `method`, `collectedAt`,
-`category`, `location`, `file`, `line`, `url`, `description`, `recipe`,
-`fixText`, `sources`, `owasp`, `wstg`), `suppressed` (`title`, `severity`,
-`reason`, `actor`, `by`, `expires`), `inconclusive`, `egress`, `actions`,
-`topActions`, `ownerActions`, `nis2`, `owasp`, `trend` and `timeline`. The
-model is built in [`src/report/model.js`](../src/report/model.js).

package/docs/funding/due-diligence-checklist.md

@@ -1,79 +0,0 @@
-# Due diligence checklist
-
-What a funder, sponsor or acquirer is likely to check, what is already in
-place, and what is still open. Checked on 2026-10-19 against the `main` branch
-at commit 156eda6.
-
-Legend: **Done**, **Open** (needs action), **Decide** (maintainer's call).
-
-## 1. Contributions and sign-off (DCO)
-
-| Item | Status | Notes |
-|------|--------|-------|
-| Contributors are all known | Done | `git shortlog -sne --all`: 54 commits as "Daan van der Zwaag <daan@devign.it>", 6 as "Daan <daan@devign.it>" (same person, commits made in the GitHub web UI), 1 from dependabot. No outside human contributors. All 8 pull requests so far were opened by the maintainer or dependabot. |
-| DCO sign-off required | Open | The Developer Certificate of Origin 1.1 (https://developercertificate.org/) lets a contributor certify they have the right to submit their code under the project licence. This PR adds a DCO section to CONTRIBUTING.md. Enforcement is not on yet. To enforce, install a DCO check app on the repo, or turn on "Require contributors to sign off on web-based commits" in repository settings. |
-| Past commits | Decide | Past commits are not signed off, but all are by the maintainer, so no outside rights are in question. A short statement in the README or this file is enough; rewriting history is not worth it. |
-| Author identity | Open | Add a `.mailmap` mapping "Daan" to "Daan van der Zwaag" so tools show one author. |
-| AI-assisted commits | Done | 45 commit messages carry `Co-Authored-By: Claude ...` trailers, recording which work was AI-assisted. NLnet's GenAI policy names commit messages as one acceptable way to log this (https://nlnet.nl/foundation/policies/generativeAI/). |
-
-## 2. Licence and copyright
-
-| Item | Status | Notes |
-|------|--------|-------|
-| Project licence | Done | MIT, in `LICENSE`, `package.json` and `.claude-plugin/plugin.json`. |
-| Copyright line | Open | `LICENSE` says "Copyright (c) 2026 daan". Change to the full legal name, or to a company if the maintainer moves the project into one: "Copyright (c) 2026 Daan van der Zwaag". |
-| Runtime dependencies | Done | One: `yaml` (ISC). Dev dependency: `vitest` (MIT). Both permissive. |
-| Third-party data in the source | Open | `lib/params.js` has a parameter wordlist with the comment "Curated from SecLists, Arjun defaults, and CommonCrawl analysis." SecLists is MIT and Arjun is AGPL-3.0 (GitHub licence metadata for both repositories). A list of common parameter names like `id` and `page` is unlikely to carry copyright on its own, but an acquirer's lawyer will ask. Options: document which entries came from where, or rebuild the list from MIT sources only and change the comment. Add a `THIRD_PARTY_NOTICES` file crediting SecLists. |
-| Other inspiration notes | Decide | The same file says "Inspired by: Arjun (6.2k stars), ParamSpider". Inspiration for an algorithm is fine; make sure no code was copied, and keep the note. |
-| Copyright of AI-assisted code | Decide | The US Copyright Office's report "Copyright and Artificial Intelligence, Part 2: Copyrightability" (29 January 2025, https://www.copyright.gov/ai/) addresses protection for AI-generated material. It is a US source; EU and Dutch law may differ. This matters little for an MIT project but may come up in an acquisition. Keep the co-author trailers as the record of human direction and review. Not legal advice. |
-| Assets | Done | `assets/` holds the project's own logo, social image and demo GIF. Confirm the logo was made by the maintainer or under a licence that allows transfer. |
-
-## 3. Name and trademark
-
-| Item | Status | Notes |
-|------|--------|-------|
-| Existing "Penthera" company | Decide | Penthera (penthera.com) is a US company, founded around 2004 to 2005, that sells a video download SDK for mobile apps and describes itself as a SaaS company for streaming providers (https://www.penthera.com/about, https://pitchbook.com/profiles/company/61416-37). Different field (video delivery, not security), but the same word. A search found no registered PENTHERA mark; that search was not exhaustive. |
-| Similar name in security | Decide | Pentera (pentera.io), formerly Pcysys, sells automated security validation and pentesting software (https://en.wikipedia.org/wiki/Pentera). Pentera Security Ltd. has filed US trademark applications for PENTERA covering security software (https://trademarks.justia.com/owners/pentera-security-ltd-5403910). "Penthera" and "Pentera" differ by one letter in the same product category. This is the bigger risk: an acquirer will notice, and a confusion claim is plausible. |
-| Recommended next steps | Open | 1. Search EUIPO eSearch plus, TMview and the BOIP register for PENTHERA and PENTERA in classes 9 and 42. 2. Ask an IP lawyer for a short clearance opinion before spending on a filing or a brand. 3. If cleared, a Benelux filing at BOIP costs EUR 244 for one class (https://boip.int/en/node/2163, verify before filing); an EU trade mark at EUIPO costs more. 4. If not cleared, a rename is cheapest now, while adoption is small. |
-| npm and GitHub names | Done | `penthera` on npm and `danoszz/penthera` on GitHub are held by the maintainer. |
-
-## 4. Security posture of the project itself
-
-| Item | Status | Notes |
-|------|--------|-------|
-| Pinned GitHub Actions | Done | Every `uses:` in `.github/workflows/` is pinned to a full commit SHA with the version in a comment. Dependabot proposes updates (an update to `actions/setup-node` is open as pull request #11). |
-| Staged npm publishing with 2FA | Done | `publish.yml` runs `npm stage publish`; nothing goes live until the maintainer approves the staged version with 2FA on npmjs.com. A hijacked workflow can stage, never ship. Merged in pull request #13. |
-| Trusted publishing, no stored token | Done | Publishing uses npm trusted publishing (OIDC). No npm token is stored in the repo or in secrets. |
-| npm provenance | Done | `--provenance` links each tarball to the workflow run and commit. |
-| CodeQL | Done | `.github/workflows/codeql.yml`. |
-| OpenSSF Scorecard | Done | Runs weekly and on push. Score 6.3 / 10 on 2026-10-19 (https://scorecard.dev/viewer/?uri=github.com/danoszz/penthera). |
-| Scorecard: Token-Permissions 0 | Open | Scorecard reports workflow tokens with excessive permissions. `publish.yml` grants `contents: write` and `id-token: write` at the top level; move them to the job and set `permissions: read-all` or `{}` at the top. Check the other workflows the same way. |
-| Scorecard: Code-Review 0 | Decide | 0 of 15 changesets were reviewed by a second person. Expected for a solo project. A second maintainer or an outside reviewer would fix it. |
-| Scorecard: Signed-Releases 0 | Open | Scorecard looks for signatures or provenance attached to GitHub Releases. npm provenance exists, but the GitHub Release has no signed artefact. Attaching the packed tarball with a provenance attestation (for example `actions/attest-build-provenance`) would cover it. |
-| Scorecard: CII-Best-Practices 0 | Open | Apply for the OpenSSF Best Practices badge (https://www.bestpractices.dev/). Most criteria are already met. |
-| Scorecard: Fuzzing 0 | Decide | Penthera has property-based API fuzzing as a feature, but the project's own code is not fuzzed. Low priority. |
-| Scorecard: Branch-Protection not scored | Open | Scorecard could not read branch protection (needs an admin token). Check that `main` requires PRs and passing CI. |
-| Security policy | Done | `SECURITY.md` with private advisory reporting, response times and safe harbour. |
-| Offline tests | Done | Tests do not reach the internet (CONTRIBUTING.md). |
-| No telemetry | Done | Stated in README "Privacy". An acquirer may want to verify it; the egress guard on the roadmap would make it testable. |
-
-## 5. Business and governance
-
-| Item | Status | Notes |
-|------|--------|-------|
-| Legal entity | Decide | The project is held by an individual. Funders such as NLnet accept individuals. An acquisition is simpler if the code, names and accounts sit in one entity. |
-| Accounts that would transfer | Open | List them: GitHub repo, npm package and its trusted publisher config, skills.sh listing, plugin marketplace entries, domain (if any), GitHub Sponsors profile. Make sure each has 2FA and a recovery path. |
-| Bus factor | Open | One maintainer. A documented release runbook exists (CONTRIBUTING.md, "Cutting a release"). Consider a second npm owner with 2FA for continuity. |
-| Funding history | Done | None so far. Keep a simple record of any grant or sponsorship income from the start. |
-| Claims in public material | Done | README and docs say "readiness" and "evidence", never "certified" or "compliant". Keep it that way in pitches. |
-
-## Sources
-
-- DCO 1.1: https://developercertificate.org/
-- NLnet GenAI policy: https://nlnet.nl/foundation/policies/generativeAI/
-- US Copyright Office AI reports: https://www.copyright.gov/ai/
-- Penthera (video SDK company): https://www.penthera.com/about , https://pitchbook.com/profiles/company/61416-37
-- Pentera: https://en.wikipedia.org/wiki/Pentera , https://trademarks.justia.com/owners/pentera-security-ltd-5403910
-- BOIP fees: https://boip.int/en/node/2163
-- OpenSSF Scorecard result: https://api.scorecard.dev/projects/github.com/danoszz/penthera
-- Arjun licence: https://github.com/s0md3v/Arjun ; SecLists licence: https://github.com/danielmiessler/SecLists