Skip to content

Independent security and release review requested for PR #11 #12

Description

@vtino17

TaskCapsule PR #11 is ready for an independent human review at fixed head SHA 931be97893a1c3ac5a49be47dca27ef52fd42329.

PR: #11
Passing CI evidence: https://github.com/vtino17/taskcapsule/actions/runs/30729469691

Please focus on:

  • recursive deletion boundaries, identifier validation, and symlink escape handling
  • stored-state identity checks and atomic/fail-closed lifecycle persistence
  • child-process environment isolation and service rollback behavior
  • Unix permission guarantees and the documented Windows ACL/experimental-support boundary
  • GitHub Actions permissions, immutable pins, reproducible release packaging, SBOM, and provenance
  • whether the tests exercise meaningful adversarial cases rather than only happy paths

To satisfy branch protection, review the PR itself and submit either Approve or Request changes. An issue comment alone does not count as the required review. Please confirm that the reviewed head SHA matches the SHA above; any later push invalidates this request.

The repository owner must not self-approve. No payment or security bounty is implied by this request.

Metadata

Metadata

Assignees

No one assigned

    Labels

    help wantedExtra attention is needed

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions