From 4088dc6545ea0746329a2e6c05cc837a1cf4e4e9 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 24 Aug 2026 15:22:31 +0000 Subject: [PATCH] docs(contributing): correct the false CodeQL security-scan claim The "Security Scans" section listed CodeQL as a scan that runs on PRs. It does not: the repository's registered-workflow listing has no `dynamic/github-code-scanning/codeql` entry (the one CodeQL "default setup" registers), while four other `dynamic/*` entries are present as the positive control, and `find .github -iname '*codeql*'` matches nothing. Replaced it with what actually runs -- Dependabot -- and added an explicit statement that no static-analysis scanning of this repo's own source code exists, so the same false inference does not re-form. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_019b5UBNMtTzKbVtZZGvFuxe --- CONTRIBUTING.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 134f8bd303..c03c78e370 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -388,8 +388,9 @@ The project enforces minimum test coverage thresholds to maintain code quality: These thresholds are intentionally set just below current coverage levels to prevent CI failures from minor fluctuations while we improve test coverage. New code should aim for higher coverage than these minimums. #### Security Scans -- **CodeQL**: Scans for security vulnerabilities in code -- **Dependency Scanning**: Checks for known vulnerabilities in dependencies +- **Dependabot**: Opens weekly dependency-update PRs for npm and GitHub Actions (configured in `.github/dependabot.yml`), and GitHub's Dependabot alerts report known vulnerabilities in dependencies. Unlike the checks above, this runs on a schedule against the default branch rather than on your PR. + +This repository does **not** run static-analysis security scanning of its own source code (CodeQL or equivalent) -- do not assume code you push is scanned for vulnerabilities beyond its dependencies. #### PR Automation - **Auto-labeling**: Automatically labels PRs based on changed files