From 0129db3f57b552d59686fda65ae94ab32e912117 Mon Sep 17 00:00:00 2001
From: Harsh Mathur <harshmathurx@gmail.com>
Date: Wed, 7 Oct 2026 14:08:34 +0530
Subject: [PATCH] chore: harden repo (pinned CI actions, read-only CI token,
 CODEOWNERS, Dependabot, SECURITY.md, PR/issue templates)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/CODEOWNERS                |  2 ++
 .github/ISSUE_TEMPLATE/config.yml |  6 ++++++
 .github/dependabot.yml            | 14 ++++++++++++++
 .github/pull_request_template.md  |  9 +++++++++
 .github/workflows/ci.yml          | 13 +++++++++++--
 CONTRIBUTING.md                   |  7 +++++++
 SECURITY.md                       | 13 +++++++++++++
 7 files changed, 62 insertions(+), 2 deletions(-)
 create mode 100644 .github/CODEOWNERS
 create mode 100644 .github/ISSUE_TEMPLATE/config.yml
 create mode 100644 .github/dependabot.yml
 create mode 100644 .github/pull_request_template.md
 create mode 100644 SECURITY.md

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..6e74db9
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,2 @@
+# Every change needs the maintainer's review.
+* @harshmathurx
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
new file mode 100644
index 0000000..05baa3b
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,6 @@
+# Blank issues stay enabled: Lector's "Report a problem" button opens a pre-filled blank issue.
+blank_issues_enabled: true
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/harshmathurx/lector/security/advisories/new
+    about: Please report security issues privately, not as a public issue.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..17ce292
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,14 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      dev:
+        dependency-type: development
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
new file mode 100644
index 0000000..98ad834
--- /dev/null
+++ b/.github/pull_request_template.md
@@ -0,0 +1,9 @@
+## What and why
+
+## How I tested
+- [ ] `bun run typecheck`, `bun test`, `bun run build`
+- [ ] Tried it in Chrome on a real article (say which)
+- [ ] For playback, chunking or engine changes: `scripts/e2e.mjs` (see its header)
+
+## Privacy
+- [ ] No new permissions, network requests, or page data leaving the browser (or explained above)
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c3e5cb8..72ed382 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,12 +3,21 @@ on:
   push:
     branches: [main]
   pull_request:
+permissions:
+  contents: read
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
 jobs:
   check:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v2
+      # Actions are pinned to commit SHAs; Dependabot keeps them current.
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
       - run: bun install --frozen-lockfile
       - run: bun run typecheck
       - run: bun test
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 47e2fe9..c5b6075 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -25,6 +25,10 @@ bun test
 2. If you touched playback, extraction or messaging, run `scripts/e2e.mjs` (header explains setup) or describe how you tested by hand.
 3. Note what you could not verify. We would rather know.
 
+## Pull requests
+
+`main` is protected: changes land through pull requests that pass CI and are approved by the maintainer (see `.github/CODEOWNERS`). Release tags (`v*`) can only be created by the maintainer.
+
 ## Releasing
 
 1. Bump `version` in `static/manifest.json` (and `package.json`).
@@ -39,6 +43,9 @@ bun test
 
 ## Reporting bugs
 
+The easiest way: Lector popup → Settings → **Report a problem** fills in your versions for you. Security issues go through [SECURITY.md](SECURITY.md), never a public issue.
+
+
 Please include the page URL (or a minimal HTML example), your Chrome version, whether you are on WebGPU or CPU (Settings in the popup shows this), and any errors from `chrome://extensions` → Lector → *service worker* / *offscreen.html* consoles.
 
 ## Architecture
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..85e9743
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,13 @@
+# Security policy
+
+Lector runs entirely in your browser: no account, no server, and no page content leaves your computer. The only network access is the one-time voice model download from Hugging Face.
+
+## Reporting a vulnerability
+
+Please report security issues **privately** through [GitHub's private vulnerability reporting](https://github.com/harshmathurx/lector/security/advisories/new), not as a public issue. Include what you found, how to reproduce it, and the Lector version (Settings in the popup, or `chrome://extensions`).
+
+You should get a reply within a week. Fixes ship in a new release on GitHub and the Chrome Web Store, and reporters are credited unless they'd rather not be.
+
+## Supported versions
+
+Only the latest release is supported.