Thejesh Reddy 36462e356e fix(security_guards): reject un-allowlisted .gitignore negations (#195) ...

check_gitignore() verified each required personal-data rule was present via set membership, but .gitignore is order-sensitive: a later !pattern re-includes a file an earlier rule excluded, so the required line stays physically present while the file is no longer ignored - the guard failed open on exactly the weakening its docstring claims to catch. Keeps the required-rules-present check and additionally rejects any negation line outside a small reviewed ALLOWED_IGNORE_NEGATIONS allowlist (same explicit-widening pattern as ALLOWED_PERMISSIONS). Fixes #194.

By @thejesh23. Verified: allowlist matches the four negations currently in .gitignore; guard test suite passes locally (17 tests) and in CI.

Closes #194

2026-07-20 18:46:58 +02:00

..

check_framework_version.py

feat(agents-config): add root AGENTS.md thin-pointer specification (#159)

2026-07-15 22:33:42 +02:00

check_upstream_updates.py

feat(agents-config): add root AGENTS.md thin-pointer specification (#159)

2026-07-15 22:33:42 +02:00

convert_salary_excel.py

fix(salary): skip non-numeric and identifier columns in Excel conversion (#152)

2026-07-14 20:11:11 +02:00

lint_skills.py

fix(lint): report malformed settings shapes without crashing (#146)

2026-07-13 20:45:22 +02:00

README_SALARY_TOOL.md

fix(salary): validate category shape and add --validate preflight (#156)

2026-07-15 07:53:01 +02:00

security_guards.py

fix(security_guards): reject un-allowlisted .gitignore negations (#195)

2026-07-20 18:46:58 +02:00

verify_pdf.py

ci: verify PDF page counts and text layers via poppler (#145)

2026-07-13 16:36:46 +02:00