@Keith Mukai I built a security audit skill for Claude a while back that tries to establish a strong security system for software based on the documented claims. I pointed it at seedsigner this morning to see what it would do. It’s relatively opinionated and there are pieces like a CI/CD check for audit on each release that might be overkill, BUT I think it flagged some interesting things. It also drafted a SECURITY.md. Posted it as a draft PR in my fork so I could share.

Key suggestions:
- one instance of a potential string injection
- suggests to pin dependencies to hashes instead of versions to decrease supply chain risk
- establishes a SECURITY.md with clear claims

https://github.com/armstrys/seedsigner/pull/1