# Scorecard Exceptions and Remediation Plan

This page records OpenSSF Scorecard findings that are not immediate code vulnerabilities and explains the current project policy, accepted risk, and remediation path.

## Current accepted exceptions

| Check | Current status | Rationale | Remediation path |
| --- | --- | --- | --- |
| Branch-Protection | Accepted temporary exception | `main` is protected by a GitHub ruleset that blocks deletion and force-pushes, requires pull requests, requires linear history, requires CI/CodeQL/Gitleaks checks, and requires resolved review threads. Required human approval, code-owner review, and last-push approval are intentionally not enabled while the repository has a single trusted maintainer because doing so can block routine maintenance and security fixes. | Enable required approvals, code-owner review, and last-push approval after adding a second trusted maintainer with verified signing and review availability. |
| Code-Review | Accepted temporary exception | Recent changes are single-maintainer changes. Bot review and automated analysis are not a substitute for independent human review, so Scorecard correctly cannot award full credit yet. | Recruit at least one additional trusted maintainer and require independent human review for protected-branch merges. |
| Maintained | Accepted time-based exception | The repository is new, and Scorecard intentionally treats projects younger than 90 days as too new to assess long-term maintenance. | Re-run Scorecard after the repository has more than 90 days of public history and weekly maintenance activity. |
| SAST | Monitoring | CodeQL is configured for Python and JavaScript/TypeScript and runs on pull requests, pushes to `main`, schedules, and manual dispatches. Scorecard currently reports partial credit because recent commit history is still catching up with SAST evidence. | Continue running CodeQL on every protected branch change; the signal should improve as reviewed/merged changes accumulate with CodeQL results. |
| CII-Best-Practices | Pending external form update | The repository has local evidence for OpenSSF Best Practices, but the public OpenSSF badge remains `InProgress` until the external Best Practices form is completed and submitted. | Complete the OpenSSF Best Practices checklist using `docs/openssf-best-practices.md` evidence links, then re-run Scorecard. |

## Findings remediated in this hardening pass

- CodeQL `js/path-injection` findings were remediated by `SafeFsPath` validation and upload-root containment in the ChatGPT Apps SDK integration.
- Scorecard `Pinned-Dependencies` findings for the container build were remediated by replacing Dockerfile `pip install` steps with a digest-pinned `uv` image and `uv`-based install steps.
- Scorecard `Fuzzing` was remediated by adding an Atheris fuzz target and scheduled fuzz workflow.

## Review policy

Accepted Scorecard exceptions must be revisited before each release and after any maintainer or repository-permission change. Do not dismiss a finding without either fixing it or documenting the accepted-risk rationale here.
