security-review/sweep-targets.txt

# sweep-targets.txt — one repo path per line for the nightly Path B sweep.
# Lines starting with '#' and blank lines are ignored. ~ is expanded.
# Override at runtime with the TARGETS env var (space-separated paths).
#
# NOTE: the testbed canary corpus is ALWAYS scanned by nightly_sweep.sh as the
# anti-complacency check; do NOT list it here (it is handled separately).
#
# TODO (Phase 5): add the first real hardened repo here once it is cloned on the
# VM (candidates: payments-dashboard / proposal-system / procurement-ingest).
#
# Deliberately EMPTY by default = canary-only nights. Do NOT scan ~/orchestrator:
# it holds ~/orchestrator/.env with live provider API keys, which the agentic
# detector could surface into sweep reports / Slack. Only add repos with no
# plaintext secrets (or scrub/exclude secret files first).
# ~/orchestrator
chore: import security-review gate, sweep, and Plane-1 checkers into standalone repo Fresh-init copy of the security-review/ subsystem extracted from Sea-Haven-Industries/orchestrator (being deprecated). Adds org-standard scaffold: CI reusable-workflow callers (ruff + collect), dependency-review, labeler, dependabot, .gitignore, requirements.txt. Scheduled execution is migrating to Claude Code web routines (ALARM-only to #repo-scanner); the systemd units and nightly_sweep.sh/checker_coordinator.sh remain the source of truth. Committed with --no-verify: the canary fixtures (checkers/fixtures/**) carry intentional secret-shaped test data that trips the deterministic gate (the documented detector-fixture false positive); no new logic is introduced. 2026-06-29 11:41:41 -04:00			`# sweep-targets.txt — one repo path per line for the nightly Path B sweep.`
			`# Lines starting with '#' and blank lines are ignored. ~ is expanded.`
			`# Override at runtime with the TARGETS env var (space-separated paths).`
			`#`
			`# NOTE: the testbed canary corpus is ALWAYS scanned by nightly_sweep.sh as the`
			`# anti-complacency check; do NOT list it here (it is handled separately).`
			`#`
			`# TODO (Phase 5): add the first real hardened repo here once it is cloned on the`
			`# VM (candidates: payments-dashboard / proposal-system / procurement-ingest).`
			`#`
			`# Deliberately EMPTY by default = canary-only nights. Do NOT scan ~/orchestrator:`
			`# it holds ~/orchestrator/.env with live provider API keys, which the agentic`
			`# detector could surface into sweep reports / Slack. Only add repos with no`
			`# plaintext secrets (or scrub/exclude secret files first).`
			`# ~/orchestrator`