security-review/sweep-targets.txt

# sweep-targets.txt — one repo path per line for the nightly Path B sweep.
# Lines starting with '#' and blank lines are ignored. ~ is expanded.
# Override at runtime with the TARGETS env var (space-separated paths).
#
# ┌─ SECURITY — TRUSTED REPOS ONLY (accepted-risk condition, 2026-07-13) ─────────┐
# │ review.sh auto-loads each scanned repo's GIT-TRACKED                          │
# │ .security-review/suppressions.json. A contributor who can land a commit can   │
# │ therefore suppress a real finding (ship the vuln + its own suppression) and   │
# │ make the automated run PASS — /sh-security-review confirmed this as HIGH and  │
# │ it was ACCEPTED only on the condition that this list (and any target list the │
# │ Open SWE daily-report automation uses) contains ONLY trusted repos. Do NOT    │
# │ add a repo that merges untrusted contributions without human review. The same │
# │ rule applies to the Open SWE daily automation's target set — keep it in sync. │
# └───────────────────────────────────────────────────────────────────────────────┘
#
# NOTE: the testbed canary corpus is ALWAYS scanned by nightly_sweep.sh as the
# anti-complacency check; do NOT list it here (it is handled separately).
#
# TODO (Phase 5): add the first real hardened repo here once it is cloned on the
# VM (candidates: payments-dashboard / proposal-system / procurement-ingest).
#
# Deliberately EMPTY by default = canary-only nights. Only add repos with no
# plaintext secrets (or scrub/exclude secret files first).