Security Sweep

How this loop works

Suggested schedule

Weekly · Mon ~6am

Loop type

Open loop — an ongoing monitor with no finish line.

Exit condition

Runs indefinitely (no finish line).

Notifications

On by default — you're alerted on each run's outcome (completion or failure). Silence with notify: never.

Ease of starting

Some setup and context are needed before the first useful run.

When you see value

The first sweep surfaces existing advisories and unpinned CI actions right away.

Set up a weekly security-sweep loop for this project. Before creating it, verify the tools this sweep needs are available on this machine - the dependency advisory source (the audit command for this stack, or gh's advisories), git history access for a secret scan, and the CI workflow files - smoke-test them once, and confirm the setup with me; never create a blind loop. Every Monday around 6am my local time, check three things: known advisories against the current dependencies, any secrets or keys leaked in recent commits, and CI actions pinned to mutable tags instead of a commit SHA. Land only provably-safe fixes - a clean advisory patch bump, a hardened action pin - as a pull request made in a fresh git worktree off the main branch and located outside the loop folder - the loop folder is a synced content home, not a workspace - so neither my working checkout nor the sync is polluted; never stack a PR while a previous Security Sweep PR is unmerged. Anything sensitive - a suspected real leaked secret, a breaking major bump, an exploit path - is report-only with a clear recommendation, never an automatic change, and never copy the secret or any credential into a report or PR. Track findings as markdown cards with front matter `type: open` or `type: merged`, and report the open-advisory count as a metric. Set up the loop's dashboard at creation: a kanban of the findings plus a chart of that count over time.