vscode-amber/docs/SECURITY.md

🔒 Security Compliance and Hardening Guidelines: MUTHUR-6000 VS Code Theme

This document defines the strict security audit requirements, secure deployment workflows, and Gitea repository protection rules established for the MUTHUR-6000 Theme Suite. It ensures our theme distribution is immune to supply-chain attacks, prevents secret leaks, and maintains repository integrity.

---

🔒 1. Supply Chain & Zero-Dependency Hardening

Many modern Javascript tools suffer from deep, transitive dependency graphs that are vulnerable to supply-chain attacks. MUTHUR-6000 is intentionally designed with a Zero-Dependency Core:

• Standard Library Only: The theme compiler (compiler.js) uses strictly native Node.js standard libraries (fs, path). It requires no third-party npm packages to run.
• Minimal devDependencies: We only declare @vscode/vsce as a development package to facilitate local extension packaging.
• Zero Shell Executions: The theme code is strictly declarative JSON. It contains no executable scripts, binaries, or active runtimes, making it impossible for the theme to execute unauthorized code on the user's host machine.

---

📦 2. Secure Packaging with VSCE

When compiling the Visual Studio Code Extension archive (.vsix), we must prevent leaks of local secrets, developer configurations, or temporary assets.

Hardening Actions:

1. Strictest .gitignore: Files such as .vscode/, .history/, node modules, credentials, and local shell scripts are actively ignored.
2. Verify Manifest Scopes: Before packaging, always inspect package.json to ensure the publisher field, homepage, and repository match our secure hosting addresses.
3. Local Build Auditing:
   • To package the extension locally, execute:

     npx @vscode/vsce package
     

   • This generates a muthur-6000-terminal-theme-1.0.0.vsix file.
   • Audit Step: Since a .vsix is a standard zip archive, you can rename the extension to .zip and inspect its contents to guarantee that only the compiled themes/ folder, documentation, manifest, and icons are present inside the artifact.

---

🔑 3. Publisher Credential Safety (Secret Leak Prevention)

To publish themes to the official VS Code Marketplace or private registries, personal access tokens (PATs) are required. Under no circumstances should these tokens be checked into Git or stored in cleartext.

• Secret Injection: Use environment variables to pass tokens to vsce dynamically:

  $env:VSCE_PAT="YOUR_SECRET_MARKETPLACE_TOKEN"
  npx @vscode/vsce publish
  

• Audit Git History: Run regular scans (e.g. gitleaks or git-secrets) before pushing code to verify that no developer keys or configurations have slipped into the commit logs.

---

🛡️ 4. Gitea Repository Branch Protections

To preserve the integrity of our codebase hosted on https://gitea.srv953353.hstgr.cloud/lovecraft/vscode-amber, the following Gitea repository configurations are highly recommended:

1. Branch Protection on main:
   • Disable direct pushes to the main branch.
   • Require code review via Pull Requests.
   • Enable "Prevent Force Pushes" to prevent remote history rewrites.
2. Commit Signature Verification:
   • Enforce "Require Signed Commits" in Gitea's branch protection.
   • Developers must sign their commits using GPG or SSH keys. Unsigned commits will be rejected by Gitea's pre-receive hooks.
3. SSH Key Authentication:
   • Always push commits using SSH keypairs (git@gitea...) rather than HTTPS username/passwords to protect transfer channels from credential sniffing.