Welcome to the BB Toolkit repository. Your security is important to us, and we take secure development practices seriously. This document outlines the security practices, disclosure guidelines, and repository protections we follow.

We enforce the following branch protection rules on the main branch:

• ✅ Require a pull request before merging
• ✅ Require linear history (no merge commits)
• ✅ Require review from Code Owners
• ✅ Require branches to be up to date before merging
• ✅ Require status checks to pass
• ✅ Block force pushes
• ✅ Restrict deletions
• 🛑 Recommended: Require signed commits (optional for solo devs)

We support integration with CodeQL or other static analysis tools. You can:

1. Enable GitHub Advanced Security on the repo
2. Add a codeql.yml workflow to scan for vulnerabilities
3. Enforce: Require code scanning results before merging

If you discover a security vulnerability within this repo:

• Please do not open an issue.
• Or open a confidential discussion (if enabled).

We recommend using:

• GPG or SSH commit signing
• Pre-commit hooks to lint or scan files
• Keeping dependencies updated with tools like pip-review, brew upgrade, or nuclei -update-templates

Security is a shared responsibility. Please:

• Keep your GitHub account secure
• Enable 2FA on your GitHub account
• Don’t push secrets or tokens — use .env and .gitignore

We may later integrate workflows for:

• Linting
• Unit testing
• Static Analysis (SAST)

Thank you for helping us keep BB Toolkit secure!

If you have suggestions to improve our security posture, feel free to open a PR or drop a message 🙌