local-ci-cd-system

Files

T

Simone a0c94cb3d3 docs(§1.6): Add threat model documentation to BEST-PRACTICES.md

§1.6 — Threat Model & Hardening Trade-offs: New section in BEST-PRACTICES.md §2.1
explains why Defender/Firewall/UAC are disabled in the template VM:
- Current state: tradeoff table (AV overhead vs attack surface, firewall fragility, UAC blocking elevated WinRM)
- Acceptable conditions: isolated lab, trusted code, no host sharing, VMnet8 not exposed
- Breaking conditions: untrusted code builds, shared host, LAN-exposed network
- Mitigations: how to re-enable each feature with specific cost/benefit trade-offs

Addresses security documentation gap — future modifications to security posture
can now reference this single authoritative source.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-10 20:18:18 +02:00

ARCHITECTURE.md

security(sprint1): §1.1/1.3/1.4 — WinRM HTTPS/5986, SHA256 pinning infra, IP regex per-octet

2026-05-10 14:46:41 +02:00

BEST-PRACTICES.md

docs(§1.6): Add threat model documentation to BEST-PRACTICES.md

2026-05-10 20:18:18 +02:00

CI-FLOW.md

docs: fix stale references across all documentation

2026-05-08 23:36:57 +02:00

HOST-SETUP.md

security(sprint1): §1.1/1.3/1.4 — WinRM HTTPS/5986, SHA256 pinning infra, IP regex per-octet