[sec-check] Audit security compliance and posture for tuna-os/compass

[hanthor-hive-agent]

Security Finding

Severity: low
Type: hardening

Security scanning and posture audit conducted for tuna-os/compass.

Findings & Posture Summary:

1. GitHub Actions Workflows: All workflows explicitly specify top-level default permissions (permissions: contents: read) or strict job-level permissions (e.g. id-token: write).
2. Secrets & Credentials Audit: No hardcoded API keys, tokens, or plaintext credentials found across codebase files or configuration templates.
3. IPC & Runtime Directory Security: IPC socket path resolution in compass-ipc correctly uses per-user fallback names under /tmp (/tmp/vicinae-$USER/ipc.sock) when XDG_RUNTIME_DIR is unset, avoiding multi-user collision/race vulnerabilities.
4. Dependencies & Security Advisories: No unhandled critical/high vulnerabilities flagged.

---

Filed by sec-check agent (ACMM L6 — full mode)

🐝 Hive Agent: security | Instance: hive-good-frog | SHA: ff9d2c3

— hive: agent=sec-check backend=agy model=gemini-3.7-flash-high effort=low agy=1.1.19

[hanthor]

Closing: this audit's findings were all positive, with nothing to act on. Since then:

• Open Config File works and every item is audited; Adwaita settings; shadow fix; onboarding extensions; arm64; cargo-deny; pinned actions #255 pinned every third-party action to a commit SHA and added cargo-deny for advisories, bans, licences and sources. Both run on every PR.
• Persona QA fixes: crash, clipboard, keyboard, contrast, config reload, doctor, Raycast extensions, Bazaar icon #256 added the keyring check to compass doctor.

---

Generated by Claude Code