From c5d47dad8a9278bba15c7097dbc80b1791f02e8b Mon Sep 17 00:00:00 2001 From: Koosha Paridehpour <42529354+KooshaPari@users.noreply.github.com> Date: Fri, 4 Sep 2026 22:33:56 -0700 Subject: [PATCH] docs(security): document socket.yml scanner config + CI workflow link (#12575) (#12764) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Merged, with one sentence removed. The `socket.yml` half checks out: the file exists at the repo root, is `version: 2`, and its `projectIgnorePaths` really do list `tests/`, `_tasks/`, `_references/`, `_ideia/`, `_mono_repo/`, `docs/` — so the paragraph describes the config accurately. The closing sentence did not: there is no `.github/workflows/socket-dev.yml` in this repo (`ls .github/workflows | grep -i socket` is empty), and nothing auto-opens `supply-chain-review/` issues. Per the documentation-accuracy rule in `AGENTS.md` — every path and workflow named in docs has to survive an `rg`/`ls` — I replaced it with what is actually true: the scan is driven by the Socket GitHub App reading `socket.yml`, not by a workflow here. Everything else merged as written. Thanks — pointing readers of SECURITY.md at the scanner config was a real gap. --- SECURITY.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index 59298ced57..ed22819804 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -224,6 +224,14 @@ features (MITM, Zed import, Cloud Sync, embedded service supervisor) — ends up in `.next/server/*.js` minified chunks. Heuristic supply-chain scanners frequently pattern-match those chunks against malware signatures. +The scanner configuration we use lives at [`socket.yml`](socket.yml) in the +repo root (Socket.dev GitHub App format v2 — see +). It explicitly excludes +non-shipped directories (`tests/`, `_tasks/`, `_references/`, `_ideia/`, +`_mono_repo/`, `docs/`, etc.) so the scanner only reports on code paths that +actually reach published users — the scan itself is driven by the Socket +GitHub App reading that file, not by a workflow in this repository. + For each finding category we maintain a per-finding maintainer attestation: - **[`docs/security/SOCKET_DEV_FINDINGS.md`](docs/security/SOCKET_DEV_FINDINGS.md)** —