pyvbaanalysis 2.2.1__tar.gz → 2.3.1__tar.gz

{pyvbaanalysis-2.2.1 → pyvbaanalysis-2.3.1}/.github/workflows/ci.yml

@@ -21,8 +21,8 @@ jobs:
     name: Lint and type check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.12"
           cache: pip
@@ -41,8 +41,8 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest]
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.12"
           cache: pip
@@ -62,8 +62,8 @@ jobs:
       matrix:
         python-version: ["3.10", "3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: ${{ matrix.python-version }}
           cache: pip

{pyvbaanalysis-2.2.1 → pyvbaanalysis-2.3.1}/.github/workflows/publish.yml

@@ -20,8 +20,18 @@ permissions:
   contents: read
 
 jobs:
+  # CodeQL, Semgrep and pip-audit (security.yml). Any finding fails this job,
+  # and publishing waits on it.
+  security:
+    name: Security analysis
+    uses: ./.github/workflows/security.yml
+    permissions:
+      contents: read
+      security-events: write
+
   publish:
     name: Build and publish to PyPI
+    needs: security
     runs-on: ubuntu-latest
     environment:
       name: pypi
@@ -29,8 +39,8 @@ jobs:
     permissions:
       id-token: write # OIDC token for PyPI Trusted Publishing
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.12"
           cache: pip
@@ -45,9 +55,29 @@ jobs:
       - name: Build sdist + wheel
         run: python -m build
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: dist
           path: dist/*
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+
+  attach-security-report:
+    name: Attach the security report to the release
+    needs: [security, publish]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        with:
+          name: security-report
+          path: report
+      - name: Upload to the release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.event.release.tag_name }}
+        run: |
+          cd report
+          tar -czf security-sarif.tar.gz *.sarif *.json
+          gh release upload "$TAG" security-report.md security-sarif.tar.gz --clobber --repo "$GITHUB_REPOSITORY"

pyvbaanalysis-2.3.1/.github/workflows/security.yml

@@ -0,0 +1,141 @@
+name: Security
+
+# Static security analysis: CodeQL (Python and the workflows themselves),
+# Semgrep, and pip-audit over the runtime dependency tree. Any finding fails
+# the run. Results go to the repository's Security tab as SARIF and to a
+# `security-report` artifact, which publish.yml attaches to every release.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: "17 6 * * 1" # weekly, so new advisories surface between pushes
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  codeql:
+    name: CodeQL (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [python, actions]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: github/codeql-action/init@1190a975f95ce23525efb6a3fc21ea29567c1b52 # v3
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-extended
+      - uses: github/codeql-action/analyze@1190a975f95ce23525efb6a3fc21ea29567c1b52 # v3
+        with:
+          category: codeql-${{ matrix.language }}
+          output: sarif
+      - name: Fail on any finding
+        run: |
+          count=$(jq '[.runs[].results[]] | length' sarif/*.sarif)
+          echo "CodeQL ${{ matrix.language }}: $count finding(s)"
+          jq -r '.runs[].results[] | "\(.ruleId): \(.locations[0].physicalLocation.artifactLocation.uri):\(.locations[0].physicalLocation.region.startLine) \(.message.text)"' sarif/*.sarif
+          test "$count" -eq 0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        if: always()
+        with:
+          name: sarif-codeql-${{ matrix.language }}
+          path: sarif/*.sarif
+
+  semgrep:
+    name: Semgrep
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.12"
+      - run: python -m pip install "semgrep>=1,<2"
+      - name: Scan (fails on any finding)
+        run: >
+          semgrep scan --metrics off --error
+          --config p/python --config p/security-audit
+          --config p/secrets --config p/github-actions
+          --sarif-output semgrep.sarif --text
+      - uses: github/codeql-action/upload-sarif@1190a975f95ce23525efb6a3fc21ea29567c1b52 # v3
+        if: always() && hashFiles('semgrep.sarif') != ''
+        with:
+          sarif_file: semgrep.sarif
+          category: semgrep
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        if: always()
+        with:
+          name: sarif-semgrep
+          path: semgrep.sarif
+
+  dependencies:
+    name: Dependency audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.12"
+      # The runtime tree without pyvbaanalysis itself, whose version is not on
+      # PyPI until the release that ships it; frozen before pip-audit is added.
+      - run: |
+          python -m pip install .
+          python -m pip freeze --exclude pyvbaanalysis > runtime.txt
+          cat runtime.txt
+          python -m pip install pip-audit
+      - name: Audit the runtime dependencies (fails on any known vulnerability)
+        run: pip-audit --strict --no-deps -r runtime.txt --format json --output pip-audit.json --progress-spinner off
+      - if: always()
+        run: pip-audit --strict --no-deps -r runtime.txt --progress-spinner off || true
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        if: always()
+        with:
+          name: pip-audit
+          path: pip-audit.json
+
+  report:
+    name: Security report
+    needs: [codeql, semgrep, dependencies]
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        with:
+          path: results
+          merge-multiple: true
+      - name: Write the report
+        env:
+          CODEQL: ${{ needs.codeql.result }}
+          SEMGREP: ${{ needs.semgrep.result }}
+          DEPS: ${{ needs.dependencies.result }}
+        run: |
+          count() { if [ -f "$1" ]; then jq '[.runs[].results[]] | length' "$1"; else echo "not run"; fi; }
+          vulns=$(if [ -f results/pip-audit.json ]; then jq '[.dependencies[].vulns[]] | length' results/pip-audit.json; else echo "not run"; fi)
+          {
+            echo "# Security report"
+            echo
+            echo "Commit \`${GITHUB_SHA}\`, run ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
+            echo
+            echo "| Check | Result | Findings |"
+            echo "| --- | --- | --- |"
+            echo "| CodeQL (Python, security-extended) | $CODEQL | $(count results/python.sarif) |"
+            echo "| CodeQL (GitHub Actions) | $CODEQL | $(count results/actions.sarif) |"
+            echo "| Semgrep (python, security-audit, secrets, github-actions) | $SEMGREP | $(count results/semgrep.sarif) |"
+            echo "| pip-audit (runtime dependencies) | $DEPS | $vulns |"
+          } > security-report.md
+          mkdir -p report && cp security-report.md report/ && cp results/*.sarif results/*.json report/ 2>/dev/null || true
+          cat security-report.md >> "$GITHUB_STEP_SUMMARY"
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: security-report
+          path: report/

{pyvbaanalysis-2.2.1 → pyvbaanalysis-2.3.1}/CHANGELOG.md

@@ -5,6 +5,164 @@ All notable changes to pyVBAanalysis are recorded here. The format follows
 follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html): a minor version
 per milestone.
 
+## 2.3.1 - 2026-09-28
+
+Sync to XLIDE 10.14.1 (commit 67b844d), from 10.14.0, and a command-line flag
+for projects that ship as one file.
+
+### Added
+
+* `--whole-project` on the command line runs the whole-project checks
+  (`undeclared-variable`, `unknown-call`, `member-not-found`) on any input,
+  a single file included, such as a single-module distribution. It cannot be
+  combined with `--partial-project`, and the default is unchanged (#15).
+* Security checks. CodeQL, Semgrep and pip-audit run on every push and pull
+  request and weekly, and any finding fails the run. A release reaches PyPI
+  only when all three pass, and it carries `security-report.md` and the raw
+  results as assets. `SECURITY.md` describes private vulnerability reporting.
+
+### Fixed
+
+* `property-accessor-signature-mismatch` on a Property Set beside a Get of
+  another type, such as a Variant Get with an Object Set. Excel compiles it:
+  a Set's value is never compared with the Get. A Let must still match its Get
+  (XLIDE issue #152).
+
+### Verified
+
+* The oracle corpus (2251 diagnostics in 1289 modules), 16 real workbooks, 195
+  Office files, 693 further projects and 7 VB6 projects give identical findings
+  from both analyzers at 10.14.1. The recorded replay of upstream's test suite
+  did not run for this release.
+
+## 2.3.0 - 2026-09-26
+
+Sync to XLIDE 10.14.0 (commit 110c76e), from 10.7.1. Upstream measured the
+analyzer against Excel, Word and PowerPoint 16.0 (build 20326) through
+pyVBAharness and answered each finding (XLIDE issues #96 to #148): 34 new
+diagnostics, 19 of them runtime errors in code the VBE compiles, and false
+positives removed on code that compiles and runs. XLIDE 10.7.2, 10.8.0, 10.11.0
+and 10.12.0 changed nothing the port reads.
+
+The port now returns what XLIDE shows, not its raw rule list, and it analyzes
+procedures nested past Python's recursion limit and long With blocks and member
+chains in linear time.
+
+### Added
+
+* Nineteen runtime errors in code the VBE compiles, each reported as "This will
+  raise Run-time error ...":
+  * Overflow (#116): `arithmetic-overflow` for Integer arithmetic such as
+    `60 * 60 * 24`, an assignment that rounds past its target, and conversions
+    out of range; `for-counter-overflow` for `For i = 1 To 32767` on an Integer.
+  * Control flow (#117): `handler-fall-through` into an error handler that
+    re-raises, `resume-without-error`, `return-without-gosub`, and
+    `recursive-property-accessor`.
+  * Collections and Variants (#121): `collection-index-out-of-range`,
+    `collection-key-not-found`, `collection-key-in-use`, `variant-value-misuse`
+    and `runtime-member-not-found` (438 on a late-bound object).
+  * Host arguments (#122): `host-argument-out-of-range` for index 0 into a
+    1-based Office collection, `Cells(0, 1)` or an Offset off the sheet;
+    `multi-cell-range-as-scalar`; `sheet-name-invalid`.
+  * File statements (#123): `file-number-zero`, `file-used-after-close`,
+    `file-mode-mismatch`, `file-already-open` and `file-record-zero`.
+* Fifteen compile errors: `const-overflow` (#116); `array-parameter-form`,
+  `bracketed-variable-name` and `duplicate-deftype` (#124);
+  `collection-operand`, `sub-used-as-value`, `implements-member-missing`,
+  `implements-member-signature` and `rem-after-then` (#125);
+  `directive-trailing-statement` and `duplicate-const-directive` (#130);
+  `stray-character` for characters VBA does not use and a no-break space
+  (#132); `line-too-long`, `date-literal-invalid` and `float-literal-overflow`
+  (#133).
+* Existing rules report more of what the code states (#118 to #120, #124 to
+  #126): `Asc("")`, `Sqr(-1)`, `Log(0)`, `CLng("abc")`, `"abc" + 1` into a
+  Variant, a divisor local that holds 0, array bounds known from `Split`,
+  `Array` or a Range literal's `Value`, `ReDim a(-1)`, `Next i, j` out of
+  order, and the line continuations the VBE refuses.
+* `AnalyzeModuleOptions.raw_rule_output`: the rules' own list, as upstream's
+  `analyzeModule` returns it, without the two steps below.
+* `resolve_host_member` in `pyvbaanalysis.host`, and `declaredType` on a host
+  model member: the type its library declares, where the model's `returns`
+  is repaired from the reference documentation.
+
+### Changed
+
+* `analyze_module`, and everything built on it, returns what XLIDE shows. A
+  runtime-error finding under `On Error Resume Next`, from that statement to the
+  next `On Error` or the end of the procedure, is dropped, since the error is
+  raised and handled there (`n = UBound(a)` is the usual allocated-array
+  test, XLIDE issue #106). Findings with one code and span are merged, the later
+  one kept. `diagnostics/module_analysis.py` ports both from XLIDE's
+  `analyzeVbaModuleSource`.
+* `member-not-found` works in Word, PowerPoint and Access: their models carry
+  the type libraries' hidden members and prove a member absent where the
+  library marks the interface NONEXTENSIBLE (#127). Document, Form, Report and
+  Control stay open. The data file `excel_closed_types.json` is replaced by
+  `host_closed_types.json`, which covers all four hosts.
+* A host member the type library declares `As Object`, such as `ActiveSheet`
+  or a `Worksheets(1)` item, is late bound (#114).
+* A hex or octal literal is the signed value of its bits: `&H8000` is -32768
+  and `&H80000000` is -2147483648 (#141). `parse_vba_integer_literal` returns
+  that value.
+* The parser opens and closes a block written in a one-line If's tail (#128),
+  reads `Else:` as the If's Else (#129), counts a block keyword restated in both
+  arms of an `#If` once (#130), and reads a numbered one-line If with an `=`
+  condition as an If (#131).
+* An Enum value or Optional default keeps its leading number, so `= 300 - 100`
+  is not the literal -100, and a module's Consts fold once with a procedure's
+  own Consts layered on top (XLIDE 10.13.0).
+
+### Fixed
+
+* False positives on code the VBE compiles and runs (#96 to #115): `Choose` and
+  `Switch` arity, `Open path` without `For`, `On Local Error`, a ReDim that
+  declares its array, `total&+1`, a library qualifier such as `Excel.`, a
+  `#Const` never defined, DAO constants in Access, `Left(Null, 1)`, a string
+  into a Byte array, a division the code guards, the Let and Set pairings of a
+  property, Nothing tracking past a GoSub or an early `Exit For`, two project
+  types sharing an instance, a Public Enum in a class, a Const or parenthesized
+  ByRef argument, `Len` in an Enum value, Option placement after a Deftype, and
+  a Function's return assigned by For, ReDim, `Line Input #` or `Get #`.
+* False positives found by this port's own hunt and fixed upstream in 10.14.0
+  (#140 to #147): `If c Is Nothing Then Set c = New Collection`, `Set a(i) = c`
+  and `AddressOf` a Sub reported as compile errors; Win32 flag Enums such as
+  `GENERIC_READ = &H80000000` as Overflow; `Err.Raise vbObjectError + 513` as
+  error 5; the `;` of `If x Then Debug.Print a; b`; a string default holding a
+  comma in an Implements signature; `32000 \ 2 * 4` folded at the wrong
+  precedence; a For counter in a loop that leaves through `Exit For`; a file
+  reopened after `Reset` or a closing helper, an error handler's `Print #`,
+  and hex file numbers; and an item added through `Set o = c`.
+* Misses from the same issues: `1 Mod 200 * 200` (error 6), `Resume Next`
+  after `On Error GoTo -1` (20), a `Print #` after `Reset` (52), a duplicate
+  key added through an alias (457), and a read-write interface property
+  implemented with its Get alone.
+* `analyze_project` raised RecursionError on a procedure nested about 490 blocks
+  deep, where the VBE compiles a thousand. Every walk over a procedure body now
+  runs on an explicit stack, and `tests/test_deep_nesting.py` fails on one that
+  recurses per block.
+
+### Performance
+
+* A long With block and a long member chain are analyzed in linear time: the
+  pass keeps upstream's With-scan index (XLIDE issue #134) and receiver-chain
+  results (#135). A 500-line With block took 14.2 seconds in 2.2.1 and takes
+  0.19; a 3,000-member chain took 16 seconds and takes 0.56.
+* Expression strings the parser carried on their own are lexed without
+  evicting the module from the token cache, and a test fails if one pass lexes
+  a module twice (#139). On two parts of the differential corpus's Office files
+  (66 modules), 2.3.0 is 12% faster than 2.2.1, new rules included.
+
+### Verified
+
+* Upstream's own 10.14.0 test suite, recorded and replayed through the port:
+  1419 standalone and 992 project calls, identical in code, span and message.
+* The oracle corpus (2155 diagnostics in 1229 modules), 16 real workbooks, 195
+  Office files of every host, 693 further projects (948 modules) and 7 VB6
+  projects: identical findings from both analyzers, compared at what XLIDE
+  shows.
+* Every expectation in the new sync tests was also run through the pinned
+  upstream analyzer.
+
 ## 2.2.1 - 2026-09-23
 
 Sync to XLIDE 10.7.1 (commit 6ead73d), from 10.6.0. Upstream fixed how its

{pyvbaanalysis-2.2.1 → pyvbaanalysis-2.3.1}/CONTRIBUTING.md

@@ -80,7 +80,8 @@ python tools/differential/harness.py projects artifacts/differential/cases/mine.
   the port, rebuilding the project index behind a call made with project context,
   and compares the diagnostics by code, span and message. It finds the gaps
   nothing else exercises: whole checks never ported, fixes older than the last
-  sync point.
+  sync point. The recorded calls are the rules alone, so the port is asked for its
+  `raw_rule_output`.
 * `corpus` runs the oracle corpus through both analyzers, each module standalone
   and with its case's modules as a project.
 * `cases` turns Office files, and folders searched for them and for exported
@@ -88,6 +89,16 @@ python tools/differential/harness.py projects artifacts/differential/cases/mine.
   block of upstream's syntax corpus, and `--host` names a host for the cases no
   file implies one for. `projects` runs a cases file through both analyzers.
 
+`corpus` and `projects` compare what XLIDE shows. Upstream runs its rules
+through `analyzeVbaModuleSource`, which drops a runtime-error finding under
+`On Error Resume Next` and merges findings with one code and span, as
+`analyze_module` does (`pyvbaanalysis/diagnostics/module_analysis.py`). Its own
+additions the port leaves out, the structural block-balance pass and XLIDE's test
+and suppression directives, are cut from its list by keeping only what its rules
+produced (`tools/differential/upstream/shown.mjs`). One step the port lacks does
+remove findings: a procedure marked `'@xlide-test expected-error=N` hides a runtime
+finding for error N. No corpus has one.
+
 `replay`, `corpus` and `projects` exit 1 when anything differs and print what only
 one side reports. Where the port reports more, the port is wrong. Where upstream
 reports more it may be an upstream false positive, so check before porting it.
@@ -104,6 +115,11 @@ run ends. `harness.py unpatch` restores a pin a run left patched, and
 ## Adding or changing a rule
 
 * Port the rule from its XLIDE source; match the behavior, not just the shape.
+* Walk a procedure body with `iter_body_nodes` or `iter_body_nodes_in_context`
+  (`pyvbaanalysis/parser/nodes.py`), not with a function that calls itself for
+  each nested block. XLIDE's walks recurse, which JavaScript's stack absorbs;
+  Python stops at 1,000 frames, and the VBE compiles blocks nested a thousand
+  deep. `tests/test_deep_nesting.py` fails on a walk that recurses per block.
 * A rule ships only with oracle backing. Validate it against the vendored corpus
   and add direct tests for the positive and the no-false-positive control cases.
 * The diagnostic rule registry order is a contract: it is the diagnostic

{pyvbaanalysis-2.2.1 → pyvbaanalysis-2.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pyvbaanalysis
-Version: 2.2.1
+Version: 2.3.1
 Summary: Pure-Python static analysis for Excel VBA
 Project-URL: Homepage, https://github.com/WilliamSmithEdward/pyVBAanalysis
 Project-URL: Repository, https://github.com/WilliamSmithEdward/pyVBAanalysis
@@ -29,6 +29,12 @@ Description-Content-Type: text/markdown
 
 # pyVBAanalysis
 
+[![CI](https://github.com/WilliamSmithEdward/pyVBAanalysis/actions/workflows/ci.yml/badge.svg)](https://github.com/WilliamSmithEdward/pyVBAanalysis/actions/workflows/ci.yml)
+[![Security](https://github.com/WilliamSmithEdward/pyVBAanalysis/actions/workflows/security.yml/badge.svg)](https://github.com/WilliamSmithEdward/pyVBAanalysis/actions/workflows/security.yml)
+[![PyPI](https://img.shields.io/pypi/v/pyvbaanalysis)](https://pypi.org/project/pyvbaanalysis/)
+[![Python](https://img.shields.io/pypi/pyversions/pyvbaanalysis)](https://pypi.org/project/pyvbaanalysis/)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
+
 Static analysis for Office VBA. It reads your macros and reports likely bugs and the
 errors the VBA compiler would catch, without opening Office or running any code.
 
@@ -135,6 +141,14 @@ an agent that changes a macro runs them afterwards and treats an error
 as a failure rather than a suggestion, which is most of what stops a
 model shipping VBA that does not compile.
 
+## Security
+
+Report a vulnerability privately through
+[GitHub's advisory form](https://github.com/WilliamSmithEdward/pyVBAanalysis/security/advisories/new),
+not a public issue. CodeQL, Semgrep and pip-audit run on every push and gate
+every release, and each release carries its security report. See
+[SECURITY.md](SECURITY.md).
+
 ## License
 
 MIT. See [LICENSE](LICENSE).

{pyvbaanalysis-2.2.1 → pyvbaanalysis-2.3.1}/README.md

@@ -1,5 +1,11 @@
 # pyVBAanalysis
 
+[![CI](https://github.com/WilliamSmithEdward/pyVBAanalysis/actions/workflows/ci.yml/badge.svg)](https://github.com/WilliamSmithEdward/pyVBAanalysis/actions/workflows/ci.yml)
+[![Security](https://github.com/WilliamSmithEdward/pyVBAanalysis/actions/workflows/security.yml/badge.svg)](https://github.com/WilliamSmithEdward/pyVBAanalysis/actions/workflows/security.yml)
+[![PyPI](https://img.shields.io/pypi/v/pyvbaanalysis)](https://pypi.org/project/pyvbaanalysis/)
+[![Python](https://img.shields.io/pypi/pyversions/pyvbaanalysis)](https://pypi.org/project/pyvbaanalysis/)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
+
 Static analysis for Office VBA. It reads your macros and reports likely bugs and the
 errors the VBA compiler would catch, without opening Office or running any code.
 
@@ -106,6 +112,14 @@ an agent that changes a macro runs them afterwards and treats an error
 as a failure rather than a suggestion, which is most of what stops a
 model shipping VBA that does not compile.
 
+## Security
+
+Report a vulnerability privately through
+[GitHub's advisory form](https://github.com/WilliamSmithEdward/pyVBAanalysis/security/advisories/new),
+not a public issue. CodeQL, Semgrep and pip-audit run on every push and gate
+every release, and each release carries its security report. See
+[SECURITY.md](SECURITY.md).
+
 ## License
 
 MIT. See [LICENSE](LICENSE).

pyvbaanalysis-2.3.1/SECURITY.md

@@ -0,0 +1,39 @@
+# Security
+
+## Supported versions
+
+Security fixes go into the latest release on PyPI. Upgrade to it before
+reporting a problem.
+
+## Reporting a vulnerability
+
+Report privately through GitHub:
+[Security > Report a vulnerability](https://github.com/WilliamSmithEdward/pyVBAanalysis/security/advisories/new).
+Please do not open a public issue for a vulnerability.
+
+Include the version, what you ran, the input that triggers the problem (a
+minimal module or file if you can share one), and what happened. You will get a
+reply within a week.
+
+## What counts
+
+pyVBAanalysis reads Office files and VBA source and never runs them. A file
+that makes the reader or the analyzer crash, hang, use unbounded memory, write
+outside where it was asked to, or run code is a vulnerability. A wrong or
+missing diagnostic is an ordinary bug; open an issue for it.
+
+## How the code is checked
+
+Every push, pull request and release runs [security.yml](.github/workflows/security.yml):
+
+- CodeQL with the `security-extended` queries, over the Python package and the
+  GitHub Actions workflows.
+- Semgrep with the `python`, `security-audit`, `secrets` and `github-actions`
+  rule sets.
+- pip-audit over the runtime dependencies.
+
+Any finding fails the run, and a release is not published to PyPI until all
+three pass. Each release carries the resulting `security-report.md` and the raw
+SARIF and pip-audit output as assets. Dependabot keeps the dependencies and the
+workflow actions current, and the run repeats weekly so new advisories surface
+between releases.