security: add weekly repository audit workflow - #95

Open

Gregory Joseph (gnjoseph) wants to merge 10 commits into

microsoft:mainfrom

gnjoseph:main--security-audit-workflow

Commits on Aug 21, 2026

Add weekly repository security audit workflow

grjoseph
and
Copilot
committed
b76e670
Harden security audit prompt boundary and target resolution

grjoseph
and
Copilot
committed
2e7140f
ci(security-audit): separate trusted controller from audited target and attribute SARIF explicitly

grjoseph
and
Copilot
committed
31389e2
fix(security-audit): deny agent instruction surfaces from the model corpus

grjoseph
and
Copilot
committed
5b2529d
Harden security audit egress, schema, and toolchain reproducibility

grjoseph
and
Copilot
committed
3cf931d
Correct security audit credential model and disclose model-assisted analysis

grjoseph
and
Copilot
committed
d39ca06
security: harden the audit workflow against public log disclosure

grjoseph
and
Copilot
committed
15be393
security: pin the audit controller to main and reject symlinks

grjoseph
and
Copilot
committed
689f395
docs(security-audit): correct governance and disclosure claims

grjoseph
and
Copilot
committed
dcb0c43
security(audit): route model findings to private reporting only

grjoseph
and
Copilot
committed
6c6669c