chore: harden public plugin security

Author: Aymericr

.github/workflows/ci.yml

@@ -5,12 +5,33 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
+  secrets:
+    name: Secret history scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          fetch-depth: 0
+      - name: Scan Git history with Gitleaks
+        shell: bash
+        run: |
+          curl --fail --location --silent --show-error \
+            https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz \
+            --output gitleaks.tar.gz
+          echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  gitleaks.tar.gz" \
+            | sha256sum --check
+          tar --extract --gzip --file gitleaks.tar.gz gitleaks
+          ./gitleaks git --redact=100 --no-banner --no-color .
+
   plugin:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: 1.3.0
       - run: bun install --frozen-lockfile
@@ -21,9 +42,9 @@ jobs:
   worker:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v6
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.12'
       - working-directory: server

README.md

@@ -1,9 +1,15 @@
 # Articraft for Pascal
 
-An external Pascal Editor plugin for articulated 3D assets. It can browse a
-Pascal-hosted mirror of Articraft-10K, place URDF assets as custom Pascal nodes,
-pose their revolute/continuous/prismatic joints, and submit prompt or reference-
-image jobs to a credentialed mini-articraft worker that returns posable USDZ.
+A standalone reference plugin showing how to integrate Articraft with Pascal
+Editor through the public Plugin API. It can browse a host-provided mirror of
+Articraft-10K, place URDF assets as custom Pascal nodes, pose their
+revolute/continuous/prismatic joints, and submit prompt or reference-image jobs
+to a credentialed mini-articraft worker that returns posable USDZ.
+
+This repository contains no private Pascal application source, deployment
+configuration, project data, provider accounts, or credentials. The browser
+plugin communicates only through the documented public plugin contracts and
+same-origin host routes described below.
 
 Placement previews use the same articulated URDF/USDZ hierarchy as committed
 nodes, with translucent non-interactive materials and live articulation. New
@@ -67,9 +73,10 @@ credentials. Hosts expose the same-origin broker described in
   It does not persist a provider key, worker bearer token, Supabase service-role
   key, or Pascal user identity.
 
-The plugin has no OAuth scopes or external account session. Report security or
-support issues through the repository's
-[GitHub issues](https://github.com/pascalorg/plugin-articraft/issues).
+The plugin has no OAuth scopes or external account session. Report suspected
+security issues privately by following [SECURITY.md](./SECURITY.md); use
+[GitHub issues](https://github.com/pascalorg/plugin-articraft/issues) for public
+support requests.
 
 ## Development
 
@@ -87,10 +94,9 @@ uv run pytest
 Read [Create a plugin](https://editor.pascal.app/docs/developers/plugins) for
 Pascal's public Plugin API v1 contract.
 
-Pascal currently consumes the reviewed Git commit and transpiles the raw
-TypeScript entrypoint, matching the Nature reference plugin. `bun run build`
-emits a code-split ESM review artifact under ignored `dist/`; no install-time
-script or network request is required.
+Hosts consuming the reviewed Git source must transpile the raw TypeScript
+entrypoint. `bun run build` emits a code-split ESM review artifact under ignored
+`dist/`; no install-time script or network request is required.
 
 ## Upstream and data attribution
 

SECURITY.md

@@ -0,0 +1,23 @@
+# Security policy
+
+## Public-demo boundary
+
+This repository is a standalone Articraft integration demo built against the
+public Pascal Plugin API. Do not commit Pascal project data, private application
+source, non-public deployment configuration or URLs, access tokens, API keys,
+worker bearer tokens, service-role credentials, or populated environment files.
+
+The browser package must never receive provider, worker, or storage credentials.
+All credentialed operations belong behind authenticated same-origin host routes;
+the example variable names in `.env.example` and `server/.env.example` must stay
+empty.
+
+## Reporting a vulnerability
+
+Please do not open a public issue for a suspected vulnerability or exposed
+secret. Use the repository's **Security** tab to submit a private vulnerability
+report. If a credential may have been exposed, revoke or rotate it immediately;
+removing it from the latest commit is not sufficient because Git history and CI
+logs may retain earlier values.
+
+Public, non-sensitive defects can be reported through GitHub Issues.

package.json

@@ -15,6 +15,7 @@
     "src",
     "HOST_INTEGRATION.md",
     "README.md",
+    "SECURITY.md",
     "LICENSE"
   ],
   "scripts": {