flowsec 0.5.2__tar.gz → 0.5.4__tar.gz

{flowsec-0.5.2 → flowsec-0.5.4}/AGENTS.md

@@ -328,6 +328,76 @@ FS003 (Excessive Permissions) fires when a GitHub workflow has `permissions: wri
 
 ---
 
+## Homebrew Tap
+
+FlowSec is distributed via a dedicated Homebrew tap in addition to PyPI.
+
+### Repositories
+
+| Repo | URL | Purpose |
+|---|---|---|
+| Main codebase | `github.com/VanshBhardwaj1945/FlowSec` | Source code, PyPI publishing |
+| Homebrew tap | `github.com/VanshBhardwaj1945/homebrew-flowsec` | Homebrew formula only |
+
+The tap repo holds a single file: `Formula/flowsec.rb`. Homebrew requires the repo to be named `homebrew-<tapname>` — this is mandatory, not a convention.
+
+### Install commands (for users)
+
+```bash
+# One-liner (taps and installs in one step)
+brew install VanshBhardwaj1945/flowsec/flowsec
+
+# Or tap first, then install
+brew tap VanshBhardwaj1945/flowsec
+brew install flowsec
+```
+
+### Local tap path (for development)
+
+When the tap is registered locally, brew stores it at:
+```
+/usr/local/Homebrew/Library/Taps/vanshbhardwaj1945/homebrew-flowsec/Formula/flowsec.rb
+```
+
+A canonical copy is also kept in this repo at `homebrew-tap/Formula/flowsec.rb`. When updating the formula, edit the canonical copy here first, then push it to the tap repo.
+
+### Formula structure
+
+The formula (`flowsec.rb`) uses `Language::Python::Virtualenv` — Homebrew's standard approach for Python CLI tools. It installs flowsec and all 36 transitive runtime dependencies into an isolated virtualenv in the Cellar. The binary at `$(brew --prefix)/bin/flowsec` is a shim into that virtualenv.
+
+Build-time dependencies: `rust` (required for `pydantic-core` and `jiter`, which are Rust extensions).
+Runtime dependencies: `libsodium` (for PyNaCl), `libyaml` (for PyYAML), `python@3.11`.
+
+### Updating the formula for a new FlowSec release
+
+When a new version is published to PyPI, the formula must be updated:
+
+1. Get the new tarball URL and SHA256 from `https://pypi.org/pypi/flowsec/X.Y.Z/json` (look in `urls` for `packagetype == "sdist"`)
+2. Update `url` and `sha256` at the top of `homebrew-tap/Formula/flowsec.rb`
+3. Check if any dependencies changed versions — re-run a pip dry-run to confirm:
+   ```bash
+   /usr/local/opt/python@3.11/libexec/bin/python -m pip install --dry-run --ignore-installed --report=/tmp/report.json flowsec==X.Y.Z
+   python3 -c "import json; [print(p['metadata']['name'], p['metadata']['version']) for p in json.load(open('/tmp/report.json'))['install']]"
+   ```
+4. If dependency versions changed, update the corresponding `resource` blocks (url + sha256). For pure-Python packages use the `-py3-none-any.whl` wheel URL. For compiled packages (cffi, cryptography, jiter, markupsafe, pydantic-core, pynacl, pyyaml, charset-normalizer) use the `.tar.gz` sdist URL.
+5. Commit the updated formula to both `homebrew-tap/Formula/flowsec.rb` in this repo **and** push it to `github.com/VanshBhardwaj1945/homebrew-flowsec`
+6. Test locally: `brew upgrade VanshBhardwaj1945/flowsec/flowsec`
+
+### Auditing and testing the formula
+
+```bash
+# Check for style/correctness issues
+brew audit --new VanshBhardwaj1945/flowsec/flowsec
+
+# Run the formula's test block
+brew test VanshBhardwaj1945/flowsec/flowsec
+
+# Full install from source
+brew install --build-from-source VanshBhardwaj1945/flowsec/flowsec
+```
+
+---
+
 ## Publishing to PyPI
 
 The project uses PyPI trusted publishing (OIDC) — no API token needed. The workflow in `.github/workflows/publish.yml` handles everything automatically when a `v*` tag is pushed. PyPI generates Sigstore attestations automatically for OIDC-published packages.
@@ -359,3 +429,4 @@ The README.md is used as the PyPI long description. Hatchling detects `text/mark
 | `tests/fixtures/` | The ground truth for what each platform's YAML looks like and what should be detected. |
 | `.github/workflows/publish.yml` | PyPI release pipeline. Triggered by `v*` tags. |
 | `.github/workflows/security.yml` | Security checks on every push/PR to main. |
+| `homebrew-tap/Formula/flowsec.rb` | Canonical copy of the Homebrew formula. Push changes here and to `github.com/VanshBhardwaj1945/homebrew-flowsec`. |

{flowsec-0.5.2 → flowsec-0.5.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: flowsec
-Version: 0.5.2
+Version: 0.5.4
 Summary: CI/CD pipeline security analyzer — scans GitHub Actions, GitLab CI, and Azure DevOps configs for attack vectors
 Author-email: Vansh Bhardwaj <Scorpio.vansh@gmail.com>
 License: MIT
@@ -33,24 +33,74 @@ Requires-Dist: responses>=0.25.3; extra == 'dev'
 Requires-Dist: ruff>=0.4.4; extra == 'dev'
 Description-Content-Type: text/markdown
 
-<p align="center">
-  <img src="docs/screenshots/flowsec-logo.png" alt="FlowSec" width="520" />
-</p>
+# FlowSec
 
-<p align="center">
-  <a href="https://codespaces.new/VanshBhardwaj1945/FlowSec"><img src="https://github.com/codespaces/badge.svg" alt="Open in GitHub Codespaces" /></a>
-  <a href="https://badge.fury.io/py/flowsec"><img src="https://badge.fury.io/py/flowsec.svg" alt="PyPI version" /></a>
-</p>
+A Python command-line security tool that scans CI/CD pipeline configurations for attack vectors across **GitHub Actions**, **GitLab CI**, and **Azure DevOps**. Every finding maps to a MITRE ATT&CK technique and an OWASP CICD Top 10 category.
 
-> A Python security tool that scans CI/CD pipeline configurations for attack vectors across GitHub Actions, GitLab CI, and Azure DevOps. Every finding maps to a MITRE ATT&CK technique and OWASP CICD Top 10 category.
->
-> The pipeline is the attack surface. FlowSec treats it that way.
+The pipeline is the attack surface. FlowSec treats it that way.
 
-**[Full documentation](docs/FULL_README.md)**
+---
+
+## Install
+
+**Homebrew (macOS):**
+
+```bash
+brew install VanshBhardwaj1945/flowsec/flowsec
+```
+
+**PyPI:**
+
+```bash
+pip install flowsec
+```
 
 ---
 
-## What it catches
+## Quick Start
+
+```bash
+# Scan a GitHub Actions repo
+export GITHUB_TOKEN=your_token
+flowsec scan --github --repo owner/repo
+
+# Scan a local GitHub Actions workflow file
+flowsec scan --github --file .github/workflows/ci.yml
+
+# Scan a GitLab CI file
+flowsec scan --gitlab --file .gitlab-ci.yml
+
+# Scan an Azure DevOps pipeline file
+flowsec scan --azure --file azure-pipelines.yml
+
+# Generate an HTML report
+flowsec scan --github --repo owner/repo --output report.html
+
+# Generate AI attack narratives (requires ANTHROPIC_API_KEY)
+flowsec scan --github --repo owner/repo --ai
+
+# Fail pipeline if findings at or above threshold
+flowsec scan --github --repo owner/repo --fail-on critical
+
+# Ignore specific rules
+flowsec scan --github --repo owner/repo --ignore FS006 --ignore FS011
+```
+
+---
+
+## Platforms and Tokens
+
+| Platform | File scan | Remote scan | Token required |
+|---|---|---|---|
+| GitHub Actions | `--github --file` | `--github --repo owner/repo` | `GITHUB_TOKEN` (remote only) |
+| GitLab CI | `--gitlab --file` | `--gitlab --repo namespace/project` | `GITLAB_TOKEN` (remote only) |
+| Azure DevOps | `--azure --file` | `--azure --repo org/project` | `AZURE_DEVOPS_TOKEN` (always — Azure requires auth even for public projects) |
+
+Set tokens in a `.env` file in your working directory or as environment variables. FlowSec loads `.env` automatically.
+
+---
+
+## 26 Security Rules
 
 | ID | Rule | Severity | MITRE | OWASP |
 |---|---|---|---|---|
@@ -83,127 +133,20 @@ Description-Content-Type: text/markdown
 
 ---
 
-## Platforms supported
-
-| Platform | File scan | Remote repo scan |
-|---|---|---|
-| GitHub Actions | `flowsec scan --github --file workflow.yml` | `flowsec scan --github --repo owner/repo` |
-| GitLab CI | `flowsec scan --gitlab --file .gitlab-ci.yml` | `flowsec scan --gitlab --repo namespace/project` |
-| Azure DevOps | `flowsec scan --azure --file azure-pipelines.yml` | `flowsec scan --azure --repo org/project` |
-
----
-
-## Real findings on a real repo
-
-Scanned `VanshBhardwaj1945/cloud-resume-challenge-azure` — 13 findings across 2 workflow files:
-
-```
-[CRITICAL] FS002 - Unpinned Action — Supply Chain Attack Vector
-  File: .github/workflows/backend.main.yaml
-  Action 'actions/checkout@v4' is not pinned to a commit hash
-
-[HIGH]     FS003 - Excessive Permissions — Overprivileged Workflow Token
-  File: .github/workflows/backend.main.yaml
-  Pipeline permissions set to 'None' — GitHub defaults apply
-
-[HIGH]     FS004 - Missing OIDC — Long-Lived Cloud Credential in Use
-  File: .github/workflows/backend.main.yaml
-  Cloud provider action present but no id-token: write permission
-
-[LOW]      FS006 - Missing Timeout — Job Runs Up to 6 Hours Unchecked
-  File: .github/workflows/backend.main.yaml
-  Job 'build-and-deploy' has no timeout — GitHub default is 6 hours
-```
-
----
-
-## Stack
-
-| Layer | Tools |
-|---|---|
-| Language | Python 3.11 |
-| GitHub Connection | PyGithub |
-| YAML Parsing | PyYAML with custom line-tracking loader |
-| Terminal Output | rich |
-| HTML Reports | Jinja2 — interactive filtering, expandable findings, PDF export |
-| AI Narratives | Anthropic Claude API with local caching |
-| Linting | ruff, mypy, bandit |
-| Packaging | hatch, pyproject.toml |
-
----
-
-## Quick Start
-
-Click the Codespaces button above to run FlowSec in your browser with zero setup. Or install from PyPI:
+## Risk Score
 
-```bash
-pip install flowsec
-export GITHUB_TOKEN=your_token_here
-flowsec scan --github --repo owner/repo
-```
-
-Or run from source:
-
-```bash
-git clone https://github.com/VanshBhardwaj1945/FlowSec.git
-cd FlowSec
-python3 -m venv .venv
-source .venv/bin/activate
-pip install -e ".[dev]"
-cp .env.example .env
-# Add your GITHUB_TOKEN to .env
-```
-
----
-
-## CLI
-
-```bash
-# Scan a GitHub Actions repo (remote)
-flowsec scan --github --repo owner/repo
-
-# Scan a local GitHub Actions file
-flowsec scan --github --file .github/workflows/ci.yml
-
-# Scan a GitLab CI file (local)
-flowsec scan --gitlab --file .gitlab-ci.yml
-
-# Scan a GitLab CI repo (remote — requires GITLAB_TOKEN)
-flowsec scan --gitlab --repo namespace/project
-
-# Scan an Azure DevOps file (local)
-flowsec scan --azure --file azure-pipelines.yml
-
-# Scan an Azure DevOps repo (remote — requires AZURE_DEVOPS_TOKEN)
-flowsec scan --azure --repo org/project
-
-# Generate an HTML report
-flowsec scan --github --repo owner/repo --output report.html
-
-# Generate AI attack narratives (requires ANTHROPIC_API_KEY)
-flowsec scan --github --repo owner/repo --ai
-
-# Ignore specific rules
-flowsec scan --github --repo owner/repo --ignore FS006 --ignore FS011
-
-# Fail pipeline if findings at or above threshold
-flowsec scan --github --repo owner/repo --fail-on critical
-
-# Everything at once
-flowsec scan --github --repo owner/repo --ai --output report.html --fail-on high
-```
+Every scan produces a 0-100 risk score using severity-weighted diminishing returns and exponential normalization. A single critical finding scores ~28. A heavily vulnerable pipeline scores ~90-97. The score cannot exceed 100.
 
 ---
 
 ## Rule Suppression
 
-Suppress specific rules inline with `--ignore`:
-
 ```bash
+# CLI flag
 flowsec scan --github --repo owner/repo --ignore FS006 --ignore FS011
-```
 
-Or create a `.flowsec.yml` in your repo root for persistent suppression:
+# .flowsec.yml in your repo root
+```
 
 ```yaml
 ignore:
@@ -217,8 +160,6 @@ ignore:
 
 ## Use as a Pipeline Gate
 
-Add FlowSec to your own GitHub Actions workflow to automatically block PRs that introduce security misconfigurations:
-
 ```yaml
 name: FlowSec Security Scan
 on: [push, pull_request]
@@ -227,56 +168,29 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - name: Install FlowSec
-        run: pip install flowsec
-      - name: Run FlowSec
-        run: flowsec scan --github --file .github/workflows/ci.yml --fail-on critical
+      - run: pip install flowsec
+      - run: flowsec scan --github --file .github/workflows/ci.yml --fail-on critical
 ```
 
-`--fail-on` supports `critical`, `high`, `medium`, and `low` thresholds.
-
 ---
 
-## Status
-
-| Component | Status |
-|---|---|
-| Rule engine — BaseRule, Finding, Severity | Complete |
-| YAML parser with line number tracking | Complete |
-| 26 security rules FS001-FS026 | Complete |
-| MITRE ATT&CK + OWASP CICD Top 10 mapping | Complete |
-| Platform-aware rule engine (GitHub/GitLab/Azure) | Complete |
-| GitHub Actions scanner — remote repo and local file | Complete |
-| GitLab CI scanner — remote repo and local file | Complete |
-| Azure DevOps scanner — remote repo and local file | Complete |
-| CLI — `--github/--gitlab/--azure` + `--file/--repo` | Complete |
-| Rich terminal output with risk score (0-100) | Complete |
-| HTML report with filtering, PDF export | Complete |
-| AI attack narratives with local caching | Complete |
-| Line number tracking | Complete |
-| Pipeline gate `--fail-on` | Complete |
-| Rule suppression `--ignore` and `.flowsec.yml` | Complete |
-| GitHub Codespace config | Complete |
-| PyPI publish with OIDC trusted publishing | Complete |
-| CI security workflow (gitleaks, bandit, pip-audit, self-scan) | Complete |
-
----
-
-## Roadmap
-
-**Phase 2 — Expansion**
-Jenkins support, AWS CodePipeline, 20+ rule library, Homebrew formula.
+## Security
 
----
+FlowSec is built to the same standard it enforces:
 
-## Security
+- All GitHub Actions pinned to commit SHAs with least-privilege permissions
+- PyPI publishing via OIDC trusted publishing — no long-lived tokens
+- Own CI runs gitleaks, bandit, pip-audit, and FlowSec self-scan on every push
+- Branch protection on main — force push blocked, 4 required status checks
+- YAML parsed with a SafeLoader subclass — no code execution risk
+- HTML reports use Jinja2 autoescape — XSS from finding content prevented
 
-See [SECURITY.md](SECURITY.md) for the responsible disclosure policy.
+Report vulnerabilities via GitHub Security Advisories or email Scorpio.vansh@gmail.com.
 
 ---
 
-## About this project
+## License
 
-Built as a security engineering portfolio project. The goal was to build an actual security tool — not run existing ones — and document every decision along the way.
+MIT — see LICENSE on GitHub.
 
-**[Read the full documentation](docs/FULL_README.md)**
+**Source:** https://github.com/VanshBhardwaj1945/FlowSec

flowsec-0.5.4/PYPI_README.md

@@ -0,0 +1,161 @@
+# FlowSec
+
+A Python command-line security tool that scans CI/CD pipeline configurations for attack vectors across **GitHub Actions**, **GitLab CI**, and **Azure DevOps**. Every finding maps to a MITRE ATT&CK technique and an OWASP CICD Top 10 category.
+
+The pipeline is the attack surface. FlowSec treats it that way.
+
+---
+
+## Install
+
+**Homebrew (macOS):**
+
+```bash
+brew install VanshBhardwaj1945/flowsec/flowsec
+```
+
+**PyPI:**
+
+```bash
+pip install flowsec
+```
+
+---
+
+## Quick Start
+
+```bash
+# Scan a GitHub Actions repo
+export GITHUB_TOKEN=your_token
+flowsec scan --github --repo owner/repo
+
+# Scan a local GitHub Actions workflow file
+flowsec scan --github --file .github/workflows/ci.yml
+
+# Scan a GitLab CI file
+flowsec scan --gitlab --file .gitlab-ci.yml
+
+# Scan an Azure DevOps pipeline file
+flowsec scan --azure --file azure-pipelines.yml
+
+# Generate an HTML report
+flowsec scan --github --repo owner/repo --output report.html
+
+# Generate AI attack narratives (requires ANTHROPIC_API_KEY)
+flowsec scan --github --repo owner/repo --ai
+
+# Fail pipeline if findings at or above threshold
+flowsec scan --github --repo owner/repo --fail-on critical
+
+# Ignore specific rules
+flowsec scan --github --repo owner/repo --ignore FS006 --ignore FS011
+```
+
+---
+
+## Platforms and Tokens
+
+| Platform | File scan | Remote scan | Token required |
+|---|---|---|---|
+| GitHub Actions | `--github --file` | `--github --repo owner/repo` | `GITHUB_TOKEN` (remote only) |
+| GitLab CI | `--gitlab --file` | `--gitlab --repo namespace/project` | `GITLAB_TOKEN` (remote only) |
+| Azure DevOps | `--azure --file` | `--azure --repo org/project` | `AZURE_DEVOPS_TOKEN` (always — Azure requires auth even for public projects) |
+
+Set tokens in a `.env` file in your working directory or as environment variables. FlowSec loads `.env` automatically.
+
+---
+
+## 26 Security Rules
+
+| ID | Rule | Severity | MITRE | OWASP |
+|---|---|---|---|---|
+| FS001 | Hardcoded Secret — Plaintext Credential in Workflow | CRITICAL | T1552.001 | CICD-SEC-6 |
+| FS002 | Unpinned Action — Supply Chain Attack Vector | CRITICAL | T1195.001 | CICD-SEC-3 |
+| FS003 | Excessive Permissions — Overprivileged Workflow Token | HIGH | T1078 | CICD-SEC-5 |
+| FS004 | Missing OIDC — Long-Lived Cloud Credential in Use | HIGH | T1552.004 | CICD-SEC-6 |
+| FS005 | Pull Request Target — Secrets Exposed to Fork Code | CRITICAL | T1611 | CICD-SEC-4 |
+| FS006 | Missing Timeout — Job Runs Up to 6 Hours Unchecked | LOW | T1499 | CICD-SEC-10 |
+| FS007 | Self-Hosted Runner — Persistent Environment Risk | HIGH | T1053 | CICD-SEC-7 |
+| FS008 | Missing Artifact Signing — No Tamper Protection | MEDIUM | T1553 | CICD-SEC-8 |
+| FS009 | Unpinned Dependency — Package Installed Without Version Lock | HIGH | T1195.002 | CICD-SEC-3 |
+| FS010 | Secret in Run Command — Plaintext Credential in Shell Step | CRITICAL | T1552.001 | CICD-SEC-6 |
+| FS011 | GitHub Context Injection — Untrusted Event Data in Run Step | CRITICAL | T1059.004 | CICD-SEC-4 |
+| FS012 | Missing Environment Protection — Deploy Job Has No Approval Gate | HIGH | T1078 | CICD-SEC-5 |
+| FS013 | Workflow Dispatch Injection — Unvalidated Input in Shell Command | CRITICAL | T1059 | CICD-SEC-9 |
+| FS014 | Mutable Container Image — Unpinned Image Tag in Pipeline | MEDIUM | T1195.001 | CICD-SEC-3 |
+| FS015 | Persist Credentials — GitHub Token Remains in Git Config After Checkout | MEDIUM | T1552.001 | CICD-SEC-6 |
+| FS016 | workflow_run Trigger — Privileged Execution from Untrusted Workflow | HIGH | T1059 | CICD-SEC-1 |
+| FS017 | Security Scan Silenced — Failures Suppressed with continue-on-error | MEDIUM | T1562.001 | CICD-SEC-7 |
+| FS018 | Secret as CLI Argument — Credential Exposed in Process List | HIGH | T1552 | CICD-SEC-6 |
+| FS019 | Unverified Install Script — Remote Code Fetched and Executed Directly | HIGH | T1195.002 | CICD-SEC-3 |
+| FS020 | Container Running as Root — Elevated Privilege in Pipeline | HIGH | T1611 | CICD-SEC-7 |
+| FS021 | Secret in Docker Build Argument — Credential Stored in Image History | HIGH | T1552.001 | CICD-SEC-6 |
+| FS022 | Broad Artifact Upload — Entire Workspace Exposed as Artifact | MEDIUM | T1560 | CICD-SEC-9 |
+| FS023 | Insecure curl — SSL Verification Disabled in Pipeline | HIGH | T1071 | CICD-SEC-3 |
+| FS024 | Privileged Docker Container — Full Host Access Granted in Pipeline | CRITICAL | T1611 | CICD-SEC-7 |
+| FS025 | Environment Variables Printed to Logs — Secrets Exposed in Pipeline Output | MEDIUM | T1552.001 | CICD-SEC-6 |
+| FS026 | Unguarded Deploy — Deployment Job Runs on Untrusted Branches | HIGH | T1078 | CICD-SEC-1 |
+
+---
+
+## Risk Score
+
+Every scan produces a 0-100 risk score using severity-weighted diminishing returns and exponential normalization. A single critical finding scores ~28. A heavily vulnerable pipeline scores ~90-97. The score cannot exceed 100.
+
+---
+
+## Rule Suppression
+
+```bash
+# CLI flag
+flowsec scan --github --repo owner/repo --ignore FS006 --ignore FS011
+
+# .flowsec.yml in your repo root
+```
+
+```yaml
+ignore:
+  - rule_id: FS006
+    reason: "We use external timeout management"
+  - rule_id: FS011
+    reason: "Branch protection managed at org level"
+```
+
+---
+
+## Use as a Pipeline Gate
+
+```yaml
+name: FlowSec Security Scan
+on: [push, pull_request]
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: pip install flowsec
+      - run: flowsec scan --github --file .github/workflows/ci.yml --fail-on critical
+```
+
+---
+
+## Security
+
+FlowSec is built to the same standard it enforces:
+
+- All GitHub Actions pinned to commit SHAs with least-privilege permissions
+- PyPI publishing via OIDC trusted publishing — no long-lived tokens
+- Own CI runs gitleaks, bandit, pip-audit, and FlowSec self-scan on every push
+- Branch protection on main — force push blocked, 4 required status checks
+- YAML parsed with a SafeLoader subclass — no code execution risk
+- HTML reports use Jinja2 autoescape — XSS from finding content prevented
+
+Report vulnerabilities via GitHub Security Advisories or email Scorpio.vansh@gmail.com.
+
+---
+
+## License
+
+MIT — see LICENSE on GitHub.
+
+**Source:** https://github.com/VanshBhardwaj1945/FlowSec

{flowsec-0.5.2 → flowsec-0.5.4}/README.md

@@ -99,7 +99,22 @@ Scanned `VanshBhardwaj1945/cloud-resume-challenge-azure` — 13 findings across
 
 ## Quick Start
 
-Click the Codespaces button above to run FlowSec in your browser with zero setup. Or install from PyPI:
+Click the Codespaces button above to run FlowSec in your browser with zero setup.
+
+**Homebrew (macOS):**
+
+```bash
+brew install VanshBhardwaj1945/flowsec/flowsec
+```
+
+Or tap once then install:
+
+```bash
+brew tap VanshBhardwaj1945/flowsec
+brew install flowsec
+```
+
+**PyPI:**
 
 ```bash
 pip install flowsec
@@ -223,6 +238,7 @@ jobs:
 | Rule suppression `--ignore` and `.flowsec.yml` | Complete |
 | GitHub Codespace config | Complete |
 | PyPI publish with OIDC trusted publishing | Complete |
+| Homebrew tap (`brew install VanshBhardwaj1945/flowsec/flowsec`) | Complete |
 | CI security workflow (gitleaks, bandit, pip-audit, self-scan) | Complete |
 
 ---
@@ -230,7 +246,7 @@ jobs:
 ## Roadmap
 
 **Phase 2 — Expansion**
-Jenkins support, AWS CodePipeline, 20+ rule library, Homebrew formula.
+Jenkins support, AWS CodePipeline, 20+ rule library.
 
 ---
 

{flowsec-0.5.2 → flowsec-0.5.4}/SECURITY.md

@@ -18,7 +18,7 @@ Include:
 - Steps to reproduce or a proof-of-concept
 - Any suggested fix (optional)
 
-You will receive a response within **72 hours** and a fix or mitigation within **14 days** for confirmed issues.
+You will receive a response within **144 hours** and a fix or mitigation within **14 days** for confirmed issues.
 
 ## Scope