acme/payments-api):
Pre-populated with a realistic fixdossier/v1 upload, advisory & commit-heuristic items, hash-chained audit events, and signed Evidence Packs.
Test reviewing items and exporting multi-page signed PDF & ZIP Evidence Packs below!
Acme Payments Ltd (Demo Org)
Org: acme (GitHub ID: 99001122) Licence: founding · activeFounding Licence Terms: Active for as long as the service runs · 1 GitHub Org · At least 90 days' notice + full self-serve export on shutdown (no refund on shutdown) · 14-day purchase refund window.
Coverage Summary — acme/payments-api
- commits: inspected most recent 250 commits on default branch (raise max_pages for pre-2025 history)
Generate Signed Evidence Pack
Creates an immutable Evidence Pack containing: (1) Multi-page PDF report, (2) security-record-reviewed.json,
(3) SUPPORT.md, and (4) pack-manifest.json signed with Ed25519 (ed25519:0961c15ac1deac6c).
| Pack ID | Mode | Generated (UTC) | SHA-256 & Ed25519 | Downloads |
|---|---|---|---|---|
| pack_9797e9e7c985b5a6 | FINAL | 2026-10-24T16:52:57Z by sara-sec |
PDF: 7268c89c1453… Sig: e6c48566985c… |
CI Upload & OIDC Request Log
Shows every request sent to POST /api/v1/ingest for your organization — whether it succeeded or failed due to an OIDC token, permission, licence, or payload issue.
| Status | Received (UTC) | Repo | Auth & Workflow Provenance | Result / Diagnostic Issue | Payload |
|---|---|---|---|---|---|
| OK · 201 | 2026-10-24T08:15:05Z | acme/payments-api | github_oidc · run #11492837412 · refs/tags/v2.4.2 · c82b17f4 | Snapshot ingested (ing_9b751ae553c40707) | 91e237808f36… · 5371 B |
| FAILED · 401 | 2026-10-18T14:18:02Z | acme/payments-api | github_oidc · run #11492821908 · refs/tags/v2.4.2 · c82b17f4 | OIDC token verification failed: unexpected OIDC audience ['https://github.com/acme'] (expected 'https://app.fixdossier.dev') | 91e237808f36… · 5371 B |
| FAILED · 401 | 2026-10-18T14:15:10Z | acme/payments-api | missing_token · run #11492810044 · refs/tags/v2.4.2 · c82b17f4 | Bearer token was literal 'null' (jq -r .value returned null) — ensure your GitHub Actions job has 'permissions: id-token: write' | 91e237808f36… · 5371 B |
Interactive Security-Fix Review Queue
Review each advisory or heuristic-detected item, set CVE/GHSA notes & engineering rationale, and record human sign-off. Every save appends a hash-chained row to audit_events.
Release Timeline & Support Policy (18 months)
Append-Only Hash-Chained Audit Log (audit_events)
| # | UTC Timestamp | Reviewer | Transition | Chain Hash |
|---|---|---|---|---|
| #7 | 2026-10-24T16:52:57Z | mikael-dev |
unreviewed → confirmed_security_fix
Enforced mandatory WithOrg(orgID) scoping on batch CSV export query. Shipped in v2.4.0.
|
7c039454ca80… |
| #6 | 2026-10-24T16:52:57Z | mikael-dev |
unreviewed → excluded_not_security
Pure internal function rename with zero behavior change. Matched commit heuristic due to 'security' in scope name.
|
d77df3a07c9d… |
| #5 | 2026-10-24T16:52:57Z | sara-sec |
unreviewed → confirmed_security_fix
Blocked IPv4-mapped IPv6 private/loopback prefixes in custom dialer before outbound webhook dispatch. Verified in v2.4.1.
|
a6b4b8816792… |
| #4 | 2026-10-24T16:52:57Z | sara-sec |
unreviewed → confirmed_security_fix
Dependabot bump of golang.org/x/crypto to 0.29.0 remediates SSH packet parsing DoS in SFTP reconciliation worker.
|
e74a24e4d10f… |
| #3 | 2026-10-24T16:52:57Z | mikael-dev |
unreviewed → confirmed_security_fix
Hardened OAuth2 PKCE verifier validation to reject plain challenge method and <43 char verifiers. Shipped in v2.4.2.
|
595e75f1961a… |
| #2 | 2026-10-24T16:52:57Z | sara-sec |
unreviewed → confirmed_security_fix
Replaced byte-by-byte string equality check with constant-time hmac.Equal in webhook middleware. Shipped in v2.4.2.
|
868925dea351… |
| #1 | 2026-10-24T16:52:57Z | sara-sec |
unreviewed → needs_followup
Fix is merged on main (commit 9e88f1c2) but not yet tagged in a release. Cut v2.4.3 release before final customer attestation.
|
3a5ce641d727… |