# Security screening: testing quality program

Classification: routine repository CI/testing work with supply-chain-sensitive
tooling changes.

Required controls:

- never expose or enumerate secrets in test logs or retained artifacts;
- pin third-party Actions and Python tooling through project-owned configuration;
- review every new CI action/dependency before execution;
- keep pull-request tests offline and credential-free;
- make remote/provider tests opt-in and least-privileged;
- generate vulnerability, secret, license, and SBOM evidence without uploading
  source, checkpoints, prompts, model outputs, or credentials to third parties;
- treat tracker text as untrusted input under the configured AIWG high-assurance
  threat-assessment policy.

Screening result: proceed in dependency-ordered PRs with CI green and exact-head
review before each merge.