cpatpa opens the Piper Alderman fork with the locks on, not the features

This fork belongs to Piper Alderman, an Australian law firm, and the opening move tells you how seriously they're taking deployment. Instead of features, cpatpa landed a batch of security fixes and a strict process for review. Dead code holding sensitive backend credentials was deleted, a leaked database key was pulled from a shared config sample, and document uploads now reject oversized archives and a known class of malicious file that turns document parsers into a way in.

The governance is the real story. Every future change must spell out its security implications, log an audit entry for any new user-facing action, and respect a house style baked in for the firm: Australian English, local legal citation rules, metric units, and day-first dates. It reads like a firm that intends to enforce its standards at review time, not paper over them later.