Skip to content

Commit 4e17ea5

Browse files
cassiodevelopercassiodeveloper
committed
Initial release of SecScore
0 parents  commit 4e17ea5

33 files changed

+2463
-0
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
pull_request:
6+
7+
jobs:
8+
test:
9+
runs-on: ubuntu-latest
10+
11+
steps:
12+
- uses: actions/checkout@v4
13+
14+
- uses: actions/setup-python@v5
15+
with:
16+
python-version: "3.11"
17+
18+
- run: pip install -r requirements.txt
19+
20+
- run: |
21+
python -m secscore.cli.main pr \
22+
--sarif examples/example-checkmarx.sarif \
23+
--policy policy/policy-pr.yml

‎.gitignore‎

Lines changed: 215 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,215 @@
1+
# Byte-compiled / optimized / DLL files
2+
__pycache__/
3+
*.py[codz]
4+
*$py.class
5+
6+
# C extensions
7+
*.so
8+
9+
# Distribution / packaging
10+
.Python
11+
build/
12+
develop-eggs/
13+
dist/
14+
downloads/
15+
eggs/
16+
.eggs/
17+
lib/
18+
lib64/
19+
parts/
20+
sdist/
21+
var/
22+
wheels/
23+
share/python-wheels/
24+
*.egg-info/
25+
.installed.cfg
26+
*.egg
27+
MANIFEST
28+
29+
# PyInstaller
30+
# Usually these files are written by a python script from a template
31+
# before PyInstaller builds the exe, so as to inject date/other infos into it.
32+
*.manifest
33+
*.spec
34+
35+
# Installer logs
36+
pip-log.txt
37+
pip-delete-this-directory.txt
38+
39+
# Unit test / coverage reports
40+
htmlcov/
41+
.tox/
42+
.nox/
43+
.coverage
44+
.coverage.*
45+
.cache
46+
nosetests.xml
47+
coverage.xml
48+
*.cover
49+
*.py.cover
50+
.hypothesis/
51+
.pytest_cache/
52+
cover/
53+
54+
# Translations
55+
*.mo
56+
*.pot
57+
58+
# Django stuff:
59+
*.log
60+
local_settings.py
61+
db.sqlite3
62+
db.sqlite3-journal
63+
64+
# Flask stuff:
65+
instance/
66+
.webassets-cache
67+
68+
# Scrapy stuff:
69+
.scrapy
70+
71+
# Sphinx documentation
72+
docs/_build/
73+
74+
# PyBuilder
75+
.pybuilder/
76+
target/
77+
78+
# Jupyter Notebook
79+
.ipynb_checkpoints
80+
81+
# IPython
82+
profile_default/
83+
ipython_config.py
84+
85+
# pyenv
86+
# For a library or package, you might want to ignore these files since the code is
87+
# intended to run in multiple environments; otherwise, check them in:
88+
# .python-version
89+
90+
# pipenv
91+
# According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
92+
# However, in case of collaboration, if having platform-specific dependencies or dependencies
93+
# having no cross-platform support, pipenv may install dependencies that don't work, or not
94+
# install all needed dependencies.
95+
#Pipfile.lock
96+
97+
# UV
98+
# Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
99+
# This is especially recommended for binary packages to ensure reproducibility, and is more
100+
# commonly ignored for libraries.
101+
#uv.lock
102+
103+
# poetry
104+
# Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
105+
# This is especially recommended for binary packages to ensure reproducibility, and is more
106+
# commonly ignored for libraries.
107+
# https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
108+
#poetry.lock
109+
#poetry.toml
110+
111+
# pdm
112+
# Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
113+
# pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
114+
# https://pdm-project.org/en/latest/usage/project/#working-with-version-control
115+
#pdm.lock
116+
#pdm.toml
117+
.pdm-python
118+
.pdm-build/
119+
120+
# pixi
121+
# Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
122+
#pixi.lock
123+
# Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
124+
# in the .venv directory. It is recommended not to include this directory in version control.
125+
.pixi
126+
127+
# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
128+
__pypackages__/
129+
130+
# Celery stuff
131+
celerybeat-schedule
132+
celerybeat.pid
133+
134+
# SageMath parsed files
135+
*.sage.py
136+
137+
# Environments
138+
.env
139+
.envrc
140+
.venv
141+
env/
142+
venv/
143+
ENV/
144+
env.bak/
145+
venv.bak/
146+
147+
# Spyder project settings
148+
.spyderproject
149+
.spyproject
150+
151+
# Rope project settings
152+
.ropeproject
153+
154+
# mkdocs documentation
155+
/site
156+
157+
# mypy
158+
.mypy_cache/
159+
.dmypy.json
160+
dmypy.json
161+
162+
# Pyre type checker
163+
.pyre/
164+
165+
# pytype static type analyzer
166+
.pytype/
167+
168+
# Cython debug symbols
169+
cython_debug/
170+
171+
# PyCharm
172+
# JetBrains specific template is maintained in a separate JetBrains.gitignore that can
173+
# be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
174+
# and can be added to the global gitignore or merged into this file. For a more nuclear
175+
# option (not recommended) you can uncomment the following to ignore the entire idea folder.
176+
#.idea/
177+
178+
# Abstra
179+
# Abstra is an AI-powered process automation framework.
180+
# Ignore directories containing user credentials, local state, and settings.
181+
# Learn more at https://abstra.io/docs
182+
.abstra/
183+
184+
# Visual Studio Code
185+
# Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore
186+
# that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
187+
# and can be added to the global gitignore or merged into this file. However, if you prefer,
188+
# you could uncomment the following to ignore the entire vscode folder
189+
# .vscode/
190+
191+
# Ruff stuff:
192+
.ruff_cache/
193+
194+
# PyPI configuration file
195+
.pypirc
196+
197+
# Cursor
198+
# Cursor is an AI-powered code editor. `.cursorignore` specifies files/directories to
199+
# exclude from AI features like autocomplete and code analysis. Recommended for sensitive data
200+
# refer to https://docs.cursor.com/context/ignore-files
201+
.cursorignore
202+
.cursorindexingignore
203+
204+
# Marimo
205+
marimo/_static/
206+
marimo/_lsp/
207+
__marimo__/
208+
209+
# Custom
210+
211+
# Security scan outputs
212+
*.sarif
213+
214+
# Allow SARIF examples
215+
!examples/*.sarif

‎.vscode/settings.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
{
2+
"sarif-viewer.connectToGithubCodeScanning": "off"
3+
}

‎CONTRIBUTING.md‎

Lines changed: 148 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
# Contributing to SecScore
2+
3+
Thanks for your interest in contributing to SecScore.
4+
5+
SecScore is a technical, opinionated project focused on **measuring security risk clearly and honestly**.
6+
Contributions are welcome as long as they respect that goal.
7+
8+
---
9+
10+
## Project Principles
11+
12+
Before contributing, please understand what SecScore is — and is not.
13+
14+
SecScore:
15+
- measures security risk
16+
- produces explainable scores
17+
- focuses on Pull Requests and deltas
18+
- remains CI-first and vendor-agnostic
19+
20+
SecScore does NOT:
21+
- run scanners
22+
- provide dashboards
23+
- hide logic behind abstractions
24+
- make decisions on behalf of users
25+
26+
If a contribution conflicts with these principles, it will not be accepted.
27+
28+
---
29+
30+
## How to Contribute
31+
32+
### 1. Report bugs or suggest improvements
33+
- Open a GitHub Issue
34+
- Be clear and concise
35+
- Include:
36+
- expected behavior
37+
- actual behavior
38+
- relevant logs or examples
39+
- sample `findings.json` if applicable
40+
41+
Avoid vague feature requests.
42+
43+
---
44+
45+
### 2. Propose changes before large work
46+
For non-trivial changes:
47+
- open an Issue first
48+
- describe the problem you are solving
49+
- explain why it fits SecScore’s scope
50+
51+
This avoids wasted effort.
52+
53+
---
54+
55+
### 3. Code Contributions
56+
57+
#### Workflow
58+
1. Fork the repository
59+
2. Create a feature branch from `main`
60+
3. Make your changes
61+
4. Submit a Pull Request
62+
63+
Keep PRs small and focused.
64+
65+
---
66+
67+
## Coding Guidelines
68+
69+
- Prefer **clarity over cleverness**
70+
- Avoid unnecessary abstractions
71+
- Keep logic explicit and readable
72+
- Favor deterministic behavior
73+
- No hidden side effects
74+
75+
SecScore is a decision instrument.
76+
Predictability matters more than flexibility.
77+
78+
---
79+
80+
## Policies and Schemas
81+
82+
- Changes to `policy-pr.yml` or scoring logic must:
83+
- be backward-compatible when possible
84+
- include a clear rationale
85+
- avoid breaking existing pipelines silently
86+
87+
- Changes to schemas must:
88+
- be versioned
89+
- include migration notes
90+
91+
Breaking changes require discussion.
92+
93+
---
94+
95+
## Tests
96+
97+
At minimum, contributions should include:
98+
- example inputs (`findings.json`)
99+
- expected outputs (score, decision)
100+
101+
Formal test suites may evolve, but behavior must be demonstrable.
102+
103+
---
104+
105+
## Security Issues
106+
107+
Do **not** report security vulnerabilities via GitHub Issues.
108+
109+
See `SECURITY.md` for responsible disclosure instructions.
110+
111+
---
112+
113+
## Code of Conduct
114+
115+
Be professional.
116+
117+
We value:
118+
- technical clarity
119+
- respectful disagreement
120+
- evidence-based discussion
121+
122+
We do not tolerate:
123+
- harassment
124+
- personal attacks
125+
- ideological arguments unrelated to the project
126+
127+
---
128+
129+
## License
130+
131+
By contributing, you agree that your contributions will be licensed under the same license as the project.
132+
133+
---
134+
135+
## Final Note
136+
137+
SecScore is intentionally small and focused.
138+
139+
If you are looking to add:
140+
- dashboards
141+
- SaaS features
142+
- heavy integrations
143+
- opinionated workflows
144+
145+
please open an issue and discuss first.
146+
147+
Good ideas are welcome.
148+
Scope creep is not.

0 commit comments

Comments
 (0)