From 111e1e4d52334338ca582b20d7c518082db46290 Mon Sep 17 00:00:00 2001
From: Will Manning <will@willmanning.io>
Date: Thu, 29 Oct 2026 22:26:45 -0400
Subject: [PATCH] fix: resolve four code-scanning alerts

- CodeQL js/bad-tag-filter and js/incomplete-multi-character-sanitization
  (high) on bench's server smoke test: the regex that strips React's
  comment markers missed comments that span lines, and one pass could
  leave a `<!--` that removing a comment created. Use [\s\S] and repeat
  until nothing changes. It only processes our own server's HTML in a
  test, so nothing was exposed.
- Scorecard Token-Permissions: claude.yml had no top-level permissions.
  Add `permissions: {}`; the job keeps the permissions it declares.
- Scorecard Security-Policy: add SECURITY.md. It sends reports to
  security@vortex.dev and points to the Vortex project's policy.
- Scorecard Vulnerabilities: GHSA-gc25-3vc5-2jf9 and GHSA-fm4j-4xhm-xpwx
  cover the npm package `sandbox` before 1.0.0, an unrelated 2011
  package whose name Vercel now publishes under. Their OSV records have
  no upper bound, so osv-scanner flags Vercel's sandbox 4.11.1 in the
  CLI's lockfile. .github/vercel-cli/osv-scanner.toml ignores both, with
  that reason; GitHub's advisory database scopes them to < 1.0.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Will Manning <will@willmanning.io>
---
 .github/vercel-cli/osv-scanner.toml | 13 +++++++++++++
 .github/workflows/claude.yml        |  3 +++
 SECURITY.md                         | 16 ++++++++++++++++
 bench/web/lib/server-smoke.test.ts  |  9 +++++++--
 4 files changed, 39 insertions(+), 2 deletions(-)
 create mode 100644 .github/vercel-cli/osv-scanner.toml
 create mode 100644 SECURITY.md

diff --git a/.github/vercel-cli/osv-scanner.toml b/.github/vercel-cli/osv-scanner.toml
new file mode 100644
index 0000000..09b89f2
--- /dev/null
+++ b/.github/vercel-cli/osv-scanner.toml
@@ -0,0 +1,13 @@
+# Read by osv-scanner, which OpenSSF Scorecard runs on package-lock.json here.
+
+# Both advisories are for the npm package `sandbox` before 1.0.0, an unrelated
+# 2011 package whose name Vercel now publishes under. The OSV records give no
+# upper bound, so osv-scanner flags every version, including Vercel's 4.x that
+# the CLI depends on. GitHub's advisory database scopes both to < 1.0.0.
+[[IgnoredVulns]]
+id = "GHSA-gc25-3vc5-2jf9"
+reason = "Affects npm sandbox < 1.0.0 only; this tree has Vercel's sandbox 4.x."
+
+[[IgnoredVulns]]
+id = "GHSA-fm4j-4xhm-xpwx"
+reason = "Affects npm sandbox < 1.0.0 only; this tree has Vercel's sandbox 4.x."
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 7f551e7..252ff88 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -20,6 +20,9 @@ on:
   issues:
     types: [opened, assigned]
 
+# Nothing by default; the job below asks for exactly what it uses.
+permissions: {}
+
 concurrency:
   group: claude-${{ github.event.issue.number || github.event.pull_request.number }}
   cancel-in-progress: false
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..a344db4
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,16 @@
+# Security Policy
+
+This repository holds the vortex.dev website and bench.vortex.dev. It follows the Vortex project's security policy: <https://github.com/vortex-data/vortex/blob/develop/SECURITY.md>.
+
+## Reporting a vulnerability
+
+Email <security@vortex.dev>. Do not report security vulnerabilities through public GitHub issues, discussions or pull requests.
+
+Include, where you can:
+
+- the affected site or page (vortex.dev or bench.vortex.dev), or the file in this repository;
+- a description of the issue and its impact;
+- steps to reproduce or a proof of concept;
+- whether the issue is publicly known or being actively exploited.
+
+The project's policy gives the response targets and the emergency process for severe or actively exploited issues.
diff --git a/bench/web/lib/server-smoke.test.ts b/bench/web/lib/server-smoke.test.ts
index bbe6832..6ea8078 100644
--- a/bench/web/lib/server-smoke.test.ts
+++ b/bench/web/lib/server-smoke.test.ts
@@ -128,8 +128,13 @@ describe.skipIf(!databaseAvailable || !BUILD_PRESENT)(
       const raw = await (await fetch(`${BASE}/chart/${slug}`)).text();
       // React's streaming SSR separates adjacent text expressions with
       // `<!-- -->` comment nodes; strip them so the assertions read the
-      // user-visible text.
-      const html = raw.replace(/<!--.*?-->/g, '');
+      // user-visible text. Comments can span lines, and removing one can join
+      // the text around it into a new `<!--`, so repeat until nothing changes.
+      let html = raw;
+      for (let previous = ''; previous !== html; ) {
+        previous = html;
+        html = html.replace(/<!--[\s\S]*?-->/g, '');
+      }
       expect(html).toContain('tpch sf=1 Q1 [nvme] - Vortex Benchmarks');
       expect(html).toContain('class="chart-meta"');
       expect(html).toContain('unit: ');