DocsGPT Security Hardening Playbook

What it is

A maintainer's playbook from the DocsGPT project (an open-source AI documentation assistant) describing the concrete security work done during a GitHub Secure Open Source Fund engagement. Beyond the artifacts the summary lists, the post's real payload is a copyable baseline for other maintainers, plus a reporting-process detail.

What to do

The post lays out a "steal this baseline" that is mostly configuration toggles, in the order the authors suggest:

• Flip on GitHub secret scanning, Dependabot, and CodeQL.
• Add a workflow scanner — they use zizmor — to harden Actions themselves: pinned action SHAs, persist-credentials: false, least-privilege permissions.
• Export an SPDX SBOM directly from the repo's dependency graph page (described as "a button, not a project") while you're there auditing/trimming dormant deps and resolving license conflicts.
• Write a threat model, "even a short one," as a public THREAT_MODEL.md — the authors note a secondary payoff not in most write-ups: a public threat model acts as a map for AI scanners and researchers, steering them away from already-closed surfaces and cutting false-positive noise.
• Add a SECURITY.md that sets a private reporting path and a 48-hour acknowledgment target.

For the sandboxed Python execution feature specifically, they used custom CodeQL queries to inventory every untrusted-input point and dangerous sink, so any new attack surface must be consciously allow-listed rather than slipping in silently. Bandit covers the Python backend.

Preconditions / Affected

Aimed at open-source maintainers on GitHub facing rising AI-authored PR volume. Most of the baseline assumes a GitHub-hosted repo (dependency graph, CodeQL, secret scanning, Dependabot are GitHub-native). The sandbox-specific mitigations matter only if you ship a code-execution feature — DocsGPT's ships off by default.

Caveats

The authors state plainly that none of this makes DocsGPT unbreakable, and that the threat model itself says so. The framing quote from Robert C. Martin — arguing humans should "disengage from code and manage from a higher level" — is cited as a provocation, and the authors explicitly say you don't have to go that far to accept the narrower point that the security baseline must be automatic. No CVEs, versions, or incident data are given; this is process guidance, not an advisory.