feat: add security infrastructure for open source

.gitignore

@@ -141,3 +141,47 @@ hs_err_pid*
 EXTERNAL/
 thoughts/
 local/
+
+# Security and credentials
+.env
+.env.*
+*.pem
+*.p12
+*.pfx
+*.cert
+*.crt
+*.key
+secrets/
+credentials/
+config/secrets.*
+config/credentials.*
+
+# API keys and tokens
+*_api_key*
+*_token*
+*.secret
+secrets.json
+secrets.yaml
+secrets.yml
+credentials.json
+credentials.yaml
+credentials.yml
+
+# Cloud provider credentials
+.aws/
+.gcp/
+.azure/
+service-account*.json
+firebase-adminsdk*.json
+
+# Database
+*.sqlite
+*.sqlite3
+*.db
+database.yml
+
+# RunAnywhere specific
+runanywhere-config.json
+runanywhere-credentials.json
+model-tokens.json
+*.rakey

.gitleaks.toml

@@ -0,0 +1,53 @@
+# Gitleaks configuration for RunAnywhere SDK
+# This configuration extends the default rules with project-specific patterns
+
+[extend]
+# Extend default gitleaks config
+useDefault = true
+
+# Additional custom rules for RunAnywhere SDK
+[[rules]]
+id = "runanywhere-api-key"
+description = "RunAnywhere API Key"
+regex = '''(?i)(runanywhere[_\-\s]?api[_\-\s]?key|RA_API_KEY|RUNANYWHERE_KEY)[\s]*[=:]\s*["']?[a-zA-Z0-9\-_]{20,}["']?'''
+tags = ["key", "RunAnywhere"]
+
+[[rules]]
+id = "model-download-token"
+description = "Model Download Token"
+regex = '''(?i)(download[_\-\s]?token|model[_\-\s]?token)[\s]*[=:]\s*["']?[a-zA-Z0-9\-_]{20,}["']?'''
+tags = ["token", "RunAnywhere"]
+
+[[rules]]
+id = "cloud-provider-key"
+description = "Cloud Provider API Key"
+regex = '''(?i)(anthropic|openai|claude|gpt)[_\-\s]?(api[_\-\s]?)?key[\s]*[=:]\s*["']?[a-zA-Z0-9\-_]{20,}["']?'''
+tags = ["key", "cloud"]
+
+# Allowlist patterns that are safe
+[allowlist]
+description = "Allowlist for RunAnywhere SDK"
+paths = [
+    # Documentation and examples
+    '''^.*\.(md|MD|markdown|rst|txt)$''',
+    # Test files with mock data
+    '''test/.*mock.*''',
+    '''.*test.*\.swift$''',
+    '''.*test.*\.kt$''',
+]
+
+# Allow truncated API keys (first 5 chars only)
+regexTarget = "line"
+regexes = [
+    # Allow API key truncation pattern used in SDK
+    '''apiKey\.take\(5\)''',
+    # Allow example/placeholder API keys
+    '''YOUR_API_KEY_HERE''',
+    '''<your-api-key>''',
+    '''placeholder_api_key''',
+    '''YOUR_TOKEN''',
+    '''1234567890abcdef1234567890abcdef''',
+    # Allow environment variable references without values
+    '''process\.env\.[A-Z_]+''',
+    '''ENV\[['"'][A-Z_]+['"']\]''',
+]

.pre-commit-config.yaml

@@ -2,6 +2,12 @@
 # See https://pre-commit.com for more information
 
 repos:
+  # Security - Gitleaks for credential detection
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.28.0
+    hooks:
+      - id: gitleaks
+
   # General hooks
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v4.5.0
@@ -13,6 +19,16 @@ repos:
         args: ['--maxkb=1000']
       - id: check-merge-conflict
 
+  # Security checks
+  - repo: local
+    hooks:
+      - id: security-check
+        name: Security checks for credentials and sensitive data
+        entry: scripts/security-check.sh
+        language: script
+        pass_filenames: false
+        always_run: true
+
   # TODO Comments Check
   - repo: local
     hooks:

CODE_OF_CONDUCT.md

@@ -0,0 +1,41 @@
+# Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, color, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior:
+
+* The use of sexualized language or imagery
+* Trolling, insulting or derogatory comments, and personal attacks
+* Public or private harassment
+* Publishing others' private information without permission
+* Other conduct which could reasonably be considered inappropriate
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of acceptable behavior and will take appropriate and fair corrective action in response to any behavior that they deem inappropriate, threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when an individual is officially representing the community in public spaces.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at conduct@runanywhere.ai.
+
+All complaints will be reviewed and investigated promptly and fairly.
+
+## Attribution
+
+This Code of Conduct is adapted from the Contributor Covenant, version 2.1, available at https://www.contributor-covenant.org/version/2/1/code_of_conduct.html