Add repo-wide audit engine, verified remediation, and release hardening

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,49 @@
+---
+name: Bug report
+about: Something in KShield isn't working as expected
+title: ""
+labels: bug
+---
+
+<!-- Check existing issues first to avoid duplicates. -->
+
+## Summary
+
+<!-- One-line description of the bug. -->
+
+## Component
+
+<!-- Which part is affected? Delete the ones that don't apply. -->
+- [ ] CLI (`kshield` binary)
+- [ ] Backend (FastAPI / detection engines)
+- [ ] Dashboard (React frontend)
+- [ ] VS Code extension
+- [ ] Installers (curl / Homebrew / npm / pip)
+- [ ] Docs
+
+## Steps to Reproduce
+
+<!-- Exact commands or UI actions, in order. -->
+1.
+2.
+3.
+
+## Expected Behaviour
+
+## Actual Behaviour
+
+## Environment
+
+- OS + architecture:
+- Python version (`python3 --version`):
+- Rust version (`rustc --version`), if building from source:
+- Node version (`node --version`), if using the frontend/extension:
+- KShield version (`kshield --version`):
+
+## Relevant Logs
+
+<!-- ~/.kshield/backend.log, browser console, or cargo/npm output. Paste as text, not a screenshot, where possible. -->
+
+```
+paste here
+```

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Report a security vulnerability
+    url: mailto:accounts@ytt.global
+    about: Do not open a public issue for security vulnerabilities — email us directly instead. See SECURITY.md.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,33 @@
+---
+name: Feature request
+about: Propose a new detection rule, CLI command, dashboard feature, or integration
+title: ""
+labels: enhancement
+---
+
+## Problem
+
+<!-- What are you trying to do, and why can't the current tool do it? -->
+
+## Proposed Solution
+
+<!-- A rough idea of how it could work. Doesn't need to be a full design. -->
+
+## Component
+
+<!-- Delete the ones that don't apply. -->
+- [ ] New detection rule (secrets / access control / dependency hallucination / other)
+- [ ] CLI command
+- [ ] Dashboard
+- [ ] VS Code extension
+- [ ] New install path or platform (e.g. Windows support)
+- [ ] CI/CD integration
+- [ ] Other
+
+## Alternatives Considered
+
+<!-- Optional — anything else you thought about, and why this approach seems best. -->
+
+---
+
+Large features (new engine rules, new UI sections, new integrations, new install paths) should be discussed here before a PR is opened — see [CONTRIBUTING.md](../../CONTRIBUTING.md).

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,19 @@
+## What Changed
+
+<!-- One or two sentences. -->
+
+## Why
+
+<!-- Link the issue this addresses, if there is one. -->
+
+## How to Test
+
+<!-- Exact steps a reviewer should follow to verify this works. -->
+
+## Checklist
+
+- [ ] Relevant checks pass locally (see [CONTRIBUTING.md](../CONTRIBUTING.md#making-a-pull-request) for the exact commands per component)
+- [ ] `kshield init` still works end-to-end after this change, if the CLI or backend was touched
+- [ ] UI changes tested in both light and dark mode, and on a mobile viewport, if the dashboard or extension UI was touched
+- [ ] Docs updated if this changes CLI commands, API endpoints, or setup steps
+- [ ] PR is focused on one concern

.github/dependabot.yml

@@ -0,0 +1,55 @@
+version: 2
+updates:
+  # Rust CLI
+  - package-ecosystem: "cargo"
+    directory: "/cli"
+    schedule:
+      interval: "weekly"
+    labels: ["dependencies", "cli"]
+    groups:
+      cargo-minor-patch:
+        update-types: ["minor", "patch"]
+
+  # Python backend
+  - package-ecosystem: "pip"
+    directory: "/backend"
+    schedule:
+      interval: "weekly"
+    labels: ["dependencies", "backend"]
+    groups:
+      pip-minor-patch:
+        update-types: ["minor", "patch"]
+
+  # React dashboard
+  - package-ecosystem: "npm"
+    directory: "/frontend"
+    schedule:
+      interval: "weekly"
+    labels: ["dependencies", "frontend"]
+    groups:
+      npm-minor-patch:
+        update-types: ["minor", "patch"]
+
+  # VS Code extension
+  - package-ecosystem: "npm"
+    directory: "/vscode-extension"
+    schedule:
+      interval: "weekly"
+    labels: ["dependencies", "vscode-extension"]
+    groups:
+      npm-minor-patch:
+        update-types: ["minor", "patch"]
+
+  # npx wrapper package
+  - package-ecosystem: "npm"
+    directory: "/npm"
+    schedule:
+      interval: "weekly"
+    labels: ["dependencies", "npm-wrapper"]
+
+  # GitHub Actions workflow versions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    labels: ["dependencies", "ci"]

.github/workflows/ci.yml

@@ -43,7 +43,8 @@ jobs:
           from app.engine.entropy import analyze_entropy_and_secrets
           from app.engine.ast_rules import run_ast_structural_scan
           from app.engine.model import sequence_classifier_node
-          from app.engine.remediation import construct_remediation_patch
+          from app.engine.ksword import construct_remediation_patch
+          from app.engine.orchestrator import run_audit
           print('All backend imports OK')
           "
         working-directory: backend

.github/workflows/codeql.yml

@@ -0,0 +1,40 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [dev, master]
+  pull_request:
+    branches: [dev, master]
+  schedule:
+    # Weekly, independent of any push — catches newly-disclosed query patterns
+    # against code that hasn't changed.
+    - cron: "17 3 * * 1"
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-22.04
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        # Rust isn't in CodeQL's supported-language set — the CLI is covered
+        # by `cargo build`/`cargo test` in ci.yml instead, not by this workflow.
+        language: ["python", "javascript-typescript"]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+
+      - uses: github/codeql-action/autobuild@v3
+
+      - uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/release.yml

@@ -26,6 +26,8 @@ jobs:
           - target: aarch64-unknown-linux-gnu
             os: ubuntu-22.04
             use_cross: true
+          - target: x86_64-pc-windows-msvc
+            os: windows-latest
 
     steps:
       - uses: actions/checkout@v4
@@ -52,20 +54,30 @@ jobs:
       - name: Package binary
         shell: bash
         run: |
-          BINARY="cli/target/${{ matrix.target }}/release/kshield"
-          TARBALL="kshield-${{ matrix.target }}.tar.gz"
-          cp "$BINARY" kshield
-          tar -czf "$TARBALL" kshield
-          rm kshield
-          sha256sum "$TARBALL" >> checksums-${{ matrix.target }}.txt 2>/dev/null \
-            || shasum -a 256 "$TARBALL" >> checksums-${{ matrix.target }}.txt
+          if [[ "${{ matrix.target }}" == *windows* ]]; then
+            BINARY="cli/target/${{ matrix.target }}/release/kshield.exe"
+            ARCHIVE="kshield-${{ matrix.target }}.zip"
+            cp "$BINARY" kshield.exe
+            7z a "$ARCHIVE" kshield.exe
+            rm kshield.exe
+          else
+            BINARY="cli/target/${{ matrix.target }}/release/kshield"
+            ARCHIVE="kshield-${{ matrix.target }}.tar.gz"
+            cp "$BINARY" kshield
+            tar -czf "$ARCHIVE" kshield
+            rm kshield
+          fi
+          sha256sum "$ARCHIVE" >> checksums-${{ matrix.target }}.txt 2>/dev/null \
+            || shasum -a 256 "$ARCHIVE" >> checksums-${{ matrix.target }}.txt
 
       - uses: actions/upload-artifact@v4
         with:
           name: binary-${{ matrix.target }}
           path: |
             kshield-${{ matrix.target }}.tar.gz
+            kshield-${{ matrix.target }}.zip
             checksums-${{ matrix.target }}.txt
+          if-no-files-found: ignore
 
   # ── Package the Python backend ───────────────────────────────────────────────
   package-backend:
@@ -141,11 +153,13 @@ jobs:
             brew install ytt-global/tap/kshield
             ```
 
-            **npm:**
+            **npm (macOS / Linux / Windows):**
             ```bash
-            npx kshield@${{ github.ref_name }} init
+            npx @ytt-global/kshield@${{ github.ref_name }} init
             ```
 
+            **Windows (manual):** download `kshield-x86_64-pc-windows-msvc.zip` below, extract, and add it to your `PATH`. Not yet covered by an install script — the npm path above handles this automatically.
+
             **pip:**
             ```bash
             pip install kshield && kshield-backend &
@@ -165,6 +179,7 @@ jobs:
             See [CHANGELOG](https://github.com/${{ github.repository }}/blob/main/CHANGELOG.md) for what's new.
           files: |
             dist/*.tar.gz
+            dist/*.zip
             checksums.txt
             homebrew/kshield.rb
           draft: false

.gitignore

@@ -8,6 +8,7 @@ backend/**/__pycache__/
 backend/**/*.pyc
 backend/.env
 backend/*.egg-info/
+backend/tests/
 
 # ── Frontend ───────────────────────────────────────────────────────────────────
 frontend/node_modules/

.kshield.yml

@@ -8,3 +8,8 @@ suppress:
     - "**/pnpm-lock.yaml"
     - "Cargo.lock"
     - "**/Cargo.lock"
+    # Test fixtures intentionally contain realistic-looking fake secrets/PATs
+    # to verify the entropy/pattern detectors actually catch them — real
+    # findings here are expected noise, not leaked credentials.
+    - "backend/tests/**"
+    - "**/backend/tests/**"