Security
Supply-chain, secret-handling, and network-boundary posture: pin by hash not tag, scan for known CVEs on every push, ship SBOMs and signatures from the release pipeline, refuse to accept secrets as flag values, and SSRF-check user-configurable URLs before the client touches them.
Decisions
byob-security.1— Pin Go dependencies by exact version; never `@latest` in CIbyob-security.2— Run govulncheck in CI on every pushbyob-security.3— Emit SBOMs and cosign signatures from the release workflowbyob-security.4— Secrets from env or OS keyring only; never as flag valuesbyob-security.5— Pin GitHub Actions by SHA; scope permissions to minimumbyob-security.6— SSRF guard on user-configurable URLs, re-checked on every redirect hop