rseng-security

Covers securing research software and its supply chain: secrets and sensitive-file hygiene (env files, keys, credentials and the never-commit file catalog) with leak response, dependency vulnerability scanning and pinning, OpenSSF Scorecard and Best Practices badge, SLSA provenance levels, SBOMs, signed releases and repository hardening. Use PROACTIVELY when setting up CI or releases, when an API key, password,…