amal66 puts a supply-chain gate in front of Mike

This fork turns dependency security from a periodic clean-up into a visible, reviewable release condition.

securityworkflow

amal66 has added a security backstop around the third-party software Mike depends on, including the less obvious components behind its web app and Word add-in. The approach clears known serious issues where safe updates are available, then makes newly disclosed problems hard to ignore.

Automated checks block releases when serious dependency vulnerabilities appear.
Dependency-update proposals arrive automatically for review.
The small number of unresolved, development-only risks are documented with reasons and removal conditions.
Ownership rules and security-focused review checks make responsibility clearer before changes land.

The useful detail is the refusal to make scanners look green by forcing untested upgrades: exceptions stay visible instead of disappearing into a waiver.

So what Legal teams and product leaders handling sensitive documents should care because this makes a common route to data exposure more accountable without pretending every alert has an instant fix.

View this fork on GitHub →

Spotted something wrong? Or know the PR text has fresher detail than the writeup above?

Commits in this thread

3 commits from amal66/mike, oldest first. Source extracted verbatim from the harvested git log.

SHA	Subject	Author	Date
`93b1f1a0`	feat(chapter-19): add API linting with security rules	Amal	2026-05-24	↗ GitHub
commit body Chapter: 19 - Automated review. Plain-English map: Add ESLint for the API workspace, including TypeScript and security-oriented rules. Why it matters: Linters catch repetitive mistakes before a human reviewer spends attention on them. That frees review time for product and architecture questions. Principle: Automate the boring parts of code review. Precedent borrowed: Open-source CI hygiene and the fork report's broad hardening pattern. Upstream base: willchen96/mike@d39f580. Original local commit: 276d1fa.
`fd362463`	ci(chapter-20): add dependency updates and ownership gates	Amal	2026-05-24	↗ GitHub
commit body Chapter: 20 - Maintenance flow. Plain-English map: Add Dependabot configuration and CODEOWNERS so dependency updates arrive regularly and sensitive paths route to designated reviewers. Why it matters: Open-source maintenance gets easier when updates are routine and review responsibility is explicit. Principle: Make maintenance systematic instead of heroic. Precedent borrowed: GitHub dependency-management and ownership conventions used across mature open-source projects. Upstream base: willchen96/mike@d39f580. Original local commit: 5723a73.
`bb249e0f`	ci(chapter-21): run audit and security lint checks in CI	Amal	2026-05-24	↗ GitHub
commit body Chapter: 21 - Security checks in the merge path. Plain-English map: Add npm audit and ESLint security scanning to the CI pipeline. Why it matters: Dependency risk and unsafe patterns should show up during pull request review, not after deployment. Principle: Security automation belongs where code is merged. Precedent borrowed: The fork report's dominant security PR cluster and common CI hardening practice. Upstream base: willchen96/mike@d39f580. Original local commit: 8cda4ca.

Capture this thread into my fork

Download a single Markdown prompt that tells Claude how to port every commit above into your working tree — adapting paths and structure to match your repo. Run it via claude -p < capture-thread-1397.md from inside the repo you want the changes in.

⬇ Download capture-thread-1397.md