Skip to content

docs: pin Authority Map remediation evidence #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
FutureEnterprises merged 1 commit into from
Aug 26, 2026
Merged

docs: pin Authority Map remediation evidence #1

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,14 @@ EMILIA Authority Map is a zero-dependency Node 24 GitHub Action that statically

Our first run against the EMILIA Protocol repository surfaced five critical
static review paths whose mutation jobs had no environment: three Python
publishers, a reusable PyPI publisher, and Dependabot's merge job. We moved the
protection to the exact mutation jobs and reran the scanner to zero critical
findings. That result identified control placement; it did not prove an exploit.
publishers, a reusable PyPI publisher, and Dependabot's merge job. The exact-job
protection was corrected in
[emilia-protocol #539](https://github.com/emiliaprotocol/emilia-protocol/pull/539).
A later source-pinned
[Authority Map run](https://github.com/emiliaprotocol/emilia-protocol/actions/runs/32958357965)
reported 52 workflows and zero critical findings. These results identify control
placement; they do not prove an exploit, complete mediation, or the absence of
runtime bypass paths.

It emits JSON and Markdown covering:

Expand Down