Security Policy

May 8, 2026 · View on GitHub

Scope

This security policy applies to the nullvariant-vscode-extensions monorepo, which contains:

Git ID Switcher (extensions/git-id-switcher/) - VS Code extension for switching Git identities

Supported Versions

Version	Supported
1.x.x	:white_check_mark:
< 1.0	:x:

Reporting a Vulnerability

If you discover a security vulnerability, please report it by:

GitHub Security Advisory (preferred)
- Go to Security tab → "Report a vulnerability"
- We will respond within 48 hours
Email
- security@nullvariant.com
- Use PGP encryption if possible (key available on request)

Please do NOT open a public issue for security vulnerabilities.

Reporting Typosquatting

If you find a VS Code extension with a similar name to Git ID Switcher from a different publisher, it may be a typosquat attempt. Please report it:

Report to us via GitHub Security Advisory or email security@nullvariant.com
Report to the marketplace:
- VS Code Marketplace: Use the "Report" button on the extension page, or email vscext@microsoft.com
- Open VSX: File an issue at open-vsx/publish-extensions

How to Verify Authenticity

Check	Expected Value
Publisher	`nullvariant`
Extension ID	`nullvariant.git-id-switcher`
Repository URL	`https://github.com/nullvariant/nullvariant-vscode-extensions`
VSIX signature	Verifiable via `cosign verify-blob` (see README)
Build provenance	Verifiable via `gh attestation verify` (SLSA Level 3)

Security Measures

This repository contains VS Code extensions with the following security measures:

Git ID Switcher

Content Security Policy (CSP): Webview content is restricted to prevent XSS attacks
Content Integrity: CDN content is verified using SHA-256 hash allowlist before rendering
No eval(): Script execution is disabled in webviews (enableScripts: false where possible)
Minimal Permissions: Only requests necessary VS Code API permissions
Command Injection Prevention: Git commands use execFile with explicit argument arrays, never string interpolation

CI/CD Security

Dependency Pinning: GitHub Actions are pinned to commit SHAs
Automated Security Scanning: CodeQL analysis runs on every push
Static Code Analysis: SonarCloud runs on every push and PR (CI-based analysis)
Daily Vulnerability Scans: npm audit runs daily via scheduled workflow
Fork Protection: Sensitive workflows skip on fork repositories
SAST (Snyk Code): Snyk runs static analysis; test fixtures are excluded via .snyk policy
License & Vulnerability Scanning: FOSSA runs license compliance, dependency quality, and security analysis on every commit (GitHub App integration)
Secret Detection: Gitleaks scans for hardcoded secrets in both CI (security.yml) and pre-commit hooks (.pre-commit-config.yaml)
Runtime Security Monitoring: StepSecurity Harden-Runner monitors all workflow runs for suspicious network egress, file access, and process execution
Branch Protection: Main branch requires PR approval (1 reviewer minimum). All PRs are automatically approved by nullvariant-justice[bot] after CI passes (solo-developer workflow for OpenSSF Scorecard compliance). Dependency bot PRs receive additional safety review before approval. Enforced by Allstar

Security Testing

Security-focused tests are included in the test suite:

npm run test:security

This includes tests for:

Command injection vectors
XSS prevention in webviews
CSP policy enforcement

Secrets Management

This section documents all secrets used in CI/CD workflows.

Repository Secrets

Name	Purpose	Used In	Rotation	Sensitivity
RELEASE_PAT	Tag push to trigger publish workflow	auto-tag.yml	90 days	High
VSCE_PAT	VS Code Marketplace publishing	publish.yml, unpublish.yml	Annual	High
OVSX_PAT	Open VSX publishing	publish.yml, unpublish.yml	Annual	High
SONAR_TOKEN	SonarCloud code analysis	sonarcloud.yml	As needed	Medium
FOSSA_API_KEY	FOSSA license/vulnerability scanning	(API access only)	As needed	Medium
CLOUDFLARE_API_TOKEN	Cloudflare Pages/R2 deployment	deploy-docs.yml, publish.yml	Annual	High
CLOUDFLARE_ACCOUNT_ID	Cloudflare account identifier (public)	deploy-docs.yml, publish.yml	Never	Low (public ID)
SLACK_WEBHOOK	Bot monitoring alerts	bot-monitoring.yml	As needed	Medium

GitHub App Secrets (6 bots × 2 secrets each)

Bot	Secrets	Used In
Justice	JUSTICE_BOT_APP_ID, JUSTICE_BOT_PRIVATE_KEY	justice-bot.yml
Luna	LUNA_BOT_APP_ID, LUNA_BOT_PRIVATE_KEY	luna-bot.yml
Slow	SLOW_BOT_APP_ID, SLOW_BOT_PRIVATE_KEY	slow-bot.yml
Blaze	BLAZE_BOT_APP_ID, BLAZE_BOT_PRIVATE_KEY	blaze-bot.yml
Ciel	CIEL_BOT_APP_ID, CIEL_BOT_PRIVATE_KEY	ciel-bot.yml
Mimi	MIMI_BOT_APP_ID, MIMI_BOT_PRIVATE_KEY	mimi-bot.yml

Security Notes for GitHub Apps:

Private Keys do not expire, but annual rotation is recommended
APP_IDs are public identifiers (low sensitivity)
Private Keys are high sensitivity - treat as passwords
Each bot has minimal permissions scoped to its specific function

Environment Protection

Marketplace publishing secrets (VSCE_PAT, OVSX_PAT) are protected by the production environment, which requires:

Tag push matching git-id-switcher-v* pattern
Repository owner approval (optional)

Note: CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID remain as repository secrets (not environment secrets) because they are also used by deploy-docs.yml, which triggers on main branch push.

Rotation Procedure

Generate new token from the provider (Azure DevOps, Open VSX, Cloudflare)
Update GitHub secret in repository settings
Verify workflow execution by triggering a test run
Revoke old token from the provider

Provider Links

Secret	Provider	Management URL	Expiration
RELEASE_PAT	GitHub	GitHub Fine-grained PAT	2026-07-15
VSCE_PAT	Azure DevOps	Azure DevOps Tokens	2027-01-08
OVSX_PAT	Open VSX	Open VSX Tokens	No expiration
CLOUDFLARE_API_TOKEN	Cloudflare	Cloudflare API Tokens	No expiration
SONAR_TOKEN	SonarCloud	SonarCloud Security	No expiration
FOSSA_API_KEY	FOSSA	FOSSA Settings	No expiration
GitHub App Keys	GitHub	GitHub Apps	No expiration
SLACK_WEBHOOK	Slack	Slack Apps	No expiration

Token Details:

CLOUDFLARE_API_TOKEN: Named nullvariant-vscode-extensions-github-actions-deploy, permissions: Workers R2 Storage:Edit
RELEASE_PAT: Named RELEASE_PAT. Fine-grained PAT scoped to this repository only. Repository permissions: Contents (Write). Used by auto-tag.yml to push release tags that trigger the publish workflow (built-in GITHUB_TOKEN pushes do not re-trigger workflows, so a PAT is required)