mirror of https://github.com/garrytan/gstack.git
e2d0a88d61
Adds /cso --fix which runs the full audit then applies a curated set of fixes where the correct change is deterministic and the risk of breakage is near-zero. Fix catalog: - FIX-01: .gitignore secret hardening (.env, *.pem, *.key, etc.) - FIX-02: Create .gitleaks.toml baseline if absent - FIX-03: npm audit fix (non-breaking patches only, no --force) - FIX-04: rejectUnauthorized: false → true (Node.js TLS bypass) - FIX-05: verify=False → True (Python requests TLS bypass) - FIX-06: InsecureSkipVerify: true → false (Go TLS bypass) - FIX-07: httpOnly: false → true on session cookies - FIX-08: secure: false → true on session cookies - FIX-09: DEBUG=true → false in production env files Each fix includes an explicit "Safe because" rationale. --fix is combinable with any existing scope flag (--code, --infra, --diff, etc.) and runs as Phase 15 after the report is complete. No changes to existing audit phases. |
||
|---|---|---|
| .. | ||
| ACKNOWLEDGEMENTS.md | ||
| SKILL.md | ||
| SKILL.md.tmpl | ||