Nikkiwei129/zero-risk-open-source-guard

Zero-Risk Open-Source Guard

Treat “zero risk” as the operating goal, not a guarantee. Run this gate immediately before every public push, including later updates to an already-public repository.

Mandatory gate

1. Resolve the exact repository or folder that will become public. Do not widen scope to unrelated private directories.

2. Run the deterministic scanner:

   python3 scripts/prepublish_guard.py /absolute/path/to/repository
   

   For a Git repository that will be pushed repeatedly, install the local enforcement hook once:

   python3 scripts/install_pre_push_hook.py /absolute/path/to/repository
   

3. Review the actual publication set: tracked, staged, modified, and untracked files. If the folder is a Git repository, also inspect reachable history because deleting a secret from the latest file does not remove it from old commits.

4. Perform a semantic review for privacy the scanner cannot reliably understand: real names, student/customer data, screenshots, chat exports, business-only context, proprietary text, private URLs, and identifying examples.

5. Classify the result:

   • BLOCKED: any suspected credential, private key, token, personal/customer/student data, secret-bearing file, external symlink, or sensitive history remains unresolved.
   • REVIEW: ambiguous personal identifiers, local absolute paths, large/binary files, or unclear licensing/provenance require human confirmation.
   • PASS: no unresolved blocking findings and all review findings have been explicitly cleared.

6. Report filenames, line numbers, detector names, and remediation. Never reproduce a suspected secret or full private value in chat, logs, commits, or reports.

7. Publishing, changing repository visibility, pushing, or rewriting Git history remains a separate user-authorized action. A passing scan is not permission to publish.

The pre-push hook is local and is not transferred by Git. Install it separately on every machine and clone used for public pushes.

If a secret ever entered Git history, stop. Removing it from the current file is insufficient: revoke/rotate the credential first, then clean history using a reviewed procedure.

Read references/checklist.md when conducting manual review or explaining a finding. Read references/remediation.md only when the scan blocks publication.