Add CodeQL SAST, a cargo-fuzz harness, and scorecard docs

.github/workflows/codeql.yml

@@ -0,0 +1,38 @@
+name: CodeQL
+
+# Static analysis finds defects independent of any code change, so it runs
+# weekly as well as on default-branch pushes and pull requests.
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '42 3 * * 0'
+
+# Least privilege by default; jobs opt into more where they need it.
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (Rust)
+    runs-on: ubuntu-latest
+    # Uploading the SARIF results requires security-events write access.
+    permissions:
+      security-events: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        with:
+          languages: rust
+
+      # Autobuild runs `cargo build`; the repo is a single crate with no
+      # workspace, so no bespoke build step is needed.
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6

.github/workflows/fuzz.yml

@@ -0,0 +1,90 @@
+name: Fuzz
+
+# Two passes with distinct goals:
+# - `smoke` is a fast crash canary for PRs and pushes to main: a small budget
+#   that surfaces regressions before merge without stalling the pipeline.
+# - `deep` is the discovery pass on schedule/manual dispatch, with a longer
+#   budget so a crash that needs more iterations is still found.
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '15 3 * * 0'
+  workflow_dispatch:
+
+# Least privilege: the jobs only check out source, build, and run locally,
+# so read-only contents is enough (no id-token, packages, or attestations).
+permissions:
+  contents: read
+
+jobs:
+  smoke:
+    name: Smoke (${{ matrix.target }})
+    # PR/push only: a short canary that should finish in a couple of minutes.
+    if: github.event_name == 'pull_request' || github.event_name == 'push'
+    runs-on: ubuntu-latest
+    strategy:
+      # Targets are independent; one crashing should not cancel the other.
+      fail-fast: false
+      matrix:
+        target: [path_normalizer, policy_parse]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      # libfuzzer-sys requires nightly for the -Z sanitizer flags.
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c
+        with:
+          toolchain: nightly
+
+      # cargo-fuzz is not preinstalled on ubuntu runners.
+      - name: Install cargo-fuzz
+        run: cargo install cargo-fuzz --locked
+
+      # Debug profile (-D): the release/ASan build trips a rustc codegen ICE in
+      # tokio under `-C passes=sancov-module` on current nightly. The debug
+      # build compiles and links cleanly and exercises the same code paths.
+      - name: Build fuzz target
+        run: cargo fuzz build ${{ matrix.target }} -D
+
+      # Small budget: crash canary only, not coverage discovery.
+      - name: Run fuzz target
+        run: cargo fuzz run ${{ matrix.target }} -D -- -max_total_time=20
+
+  deep:
+    name: Deep (${{ matrix.target }})
+    # Schedule/manual only: the longer discovery pass.
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    strategy:
+      # Targets are independent; one crashing should not cancel the other.
+      fail-fast: false
+      matrix:
+        target: [path_normalizer, policy_parse]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      # libfuzzer-sys requires nightly for the -Z sanitizer flags.
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c
+        with:
+          toolchain: nightly
+
+      # cargo-fuzz is not preinstalled on ubuntu runners.
+      - name: Install cargo-fuzz
+        run: cargo install cargo-fuzz --locked
+
+      # Debug profile (-D): the release/ASan build trips a rustc codegen ICE in
+      # tokio under `-C passes=sancov-module` on current nightly. The debug
+      # build compiles and links cleanly and exercises the same code paths.
+      - name: Build fuzz target
+        run: cargo fuzz build ${{ matrix.target }} -D
+
+      # Longer bounded budget for the discovery pass; a found crash exits
+      # non-zero and fails the job.
+      - name: Run fuzz target
+        run: cargo fuzz run ${{ matrix.target }} -D -- -max_total_time=300

CONTRIBUTING.md

@@ -0,0 +1,23 @@
+# Contributing
+
+Contributions are welcome via GitHub issues and pull requests.
+
+## Reporting problems
+
+- Bugs and feature requests: open an [issue](https://github.com/logxel/docker-socket-proxy/issues).
+- Security vulnerabilities: do NOT open a public issue — see [`SECURITY.md`](SECURITY.md).
+
+## Development workflow
+
+1. Fork the repository and create a branch off `main`.
+2. Make a focused, minimal change.
+3. Verify it passes the checks enforced in CI:
+   - `cargo fmt --all --check`
+   - `cargo clippy --all-targets -- -D warnings`
+   - `cargo test --all-targets`
+4. Add tests for new functionality.
+5. Open a pull request.
+
+Coding standards are documented in [`AGENTS.md`](AGENTS.md) ("Code Quality
+Standards"): production code must not use `unwrap()`, `expect()`, or `panic!`,
+`unsafe` is forbidden, and new functionality is expected to ship with tests.

README.md

@@ -271,6 +271,35 @@ docker-socket-proxy --health-check    # exits 0 when healthy, 1 otherwise
 
 Conformance targets, adoption decisions, and their measured dependency cost are documented in [`docs/standards.md`](docs/standards.md). The target state is described in [`AGENTS.md`](AGENTS.md).
 
+## Scorecard
+
+[OpenSSF Scorecard](https://scorecard.dev/viewer/?uri=github.com/logxel/docker-socket-proxy)
+grades repository practices rather than code. It runs weekly and on `main`
+pushes via [`.github/workflows/scorecard.yml`](.github/workflows/scorecard.yml).
+
+Code-fixable checks, in place:
+
+- **SAST** — CodeQL for Rust runs from
+  [`.github/workflows/codeql.yml`](.github/workflows/codeql.yml) (`language: rust`).
+- **Fuzzing** — a cargo-fuzz / libfuzzer-sys harness in [`fuzz/`](fuzz/) targets the
+  request-path decision surface and policy parsing (`path_normalizer`,
+  `policy_parse`), exercised by a scheduled job in
+  [`.github/workflows/fuzz.yml`](.github/workflows/fuzz.yml).
+
+The remaining checks need repository or account settings, not code:
+
+- **Code-Review** — a PR review policy that gates merges on approved reviews.
+- **Branch-Protection** — branch-protection rules enabled on `main`.
+- **Maintained** — time-gated; the repository ages into this one.
+- **Contributors** — contributors from more than one organization.
+- **Signed-Releases** — a published release; signing is already wired into the
+  release workflow.
+- **CII-Best-Practices** — self-certification at
+  [bestpractices.dev](https://www.bestpractices.dev).
+
+The numeric score refreshes only when the scorecard action re-runs — weekly, or
+on a `main` push.
+
 ## Contributing
 
 Security issues: see [`SECURITY.md`](SECURITY.md). Release history: [`CHANGELOG.md`](CHANGELOG.md).

SECURITY.md

@@ -45,10 +45,5 @@ These are documented properties of the current design, not vulnerabilities. See
 
 ## Known Gaps
 
-Tracked openly in [`STATUS.md`](STATUS.md) rather than treated as embargoed
-issues, since each is a documented limitation rather than an exploitable
-regression:
-
-- Policy denials produce no audit record
-- No request timeout or body-size limit
-- Path normalization does not yet implement RFC 3986 §6
+Remaining limitations are tracked in [`STATUS.md`](STATUS.md) rather than
+restated here or treated as embargoed issues.

STATUS.md

@@ -63,6 +63,9 @@ is otherwise silent. Shipped patterns are checked by test, not warning.
 asserting the shipped examples still behave as documented, 3 checking policy
 patterns against the real Docker Engine API surface).
 
+The OpenSSF Scorecard posture — checks addressed and those still outstanding —
+is documented in the README's [Scorecard](README.md#scorecard) section.
+
 ## Known Gaps
 Ordered by the waves in [`docs/standards.md`](docs/standards.md#next-steps).
 Identifiers are stable; closed gaps are not renumbered.

fuzz/.gitignore

@@ -0,0 +1,6 @@
+# Fuzz-crate build artifacts (separate from the root /target)
+/target/
+
+# cargo-fuzz runtime output
+/corpus/
+/artifacts/