From 8ea42e4e658efdd14421d476f7db6d56bae6d751 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 21:39:50 -0700 Subject: [PATCH 1/2] test(security): reject normalized evidence timestamp identity --- test/security-checklist.test.ts | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/test/security-checklist.test.ts b/test/security-checklist.test.ts index 61bcc8b1c..fd313fc26 100644 --- a/test/security-checklist.test.ts +++ b/test/security-checklist.test.ts @@ -67,6 +67,13 @@ describe("security validation checklist parser", () => { expect(result.failures).toEqual([]); }); + it("rejects surrounding whitespace instead of normalizing security evidence timestamp identity", () => { + const result = evaluateSecurityEvidence(reviewedSecurityEvidence(" 2026-07-02T10:30:15.250Z ")); + + expect(result.passed).toBe(false); + expect(result.failures).toContain("updated_at must be an ISO date or timestamp"); + }); + it("rejects security evidence dated even slightly in the future", () => { const futureTimestamp = new Date(Date.now() + 60 * 60 * 1000).toISOString(); const result = evaluateSecurityEvidence(reviewedSecurityEvidence(futureTimestamp)); From e87f71be9f3300c8289ce5e0daef1a534d6858f3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 22 Aug 2026 21:42:26 -0700 Subject: [PATCH 2/2] fix(security): preserve exact evidence timestamp identity --- scripts/lib/security-checklist.mjs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/lib/security-checklist.mjs b/scripts/lib/security-checklist.mjs index 18fc272b5..e133c42ed 100644 --- a/scripts/lib/security-checklist.mjs +++ b/scripts/lib/security-checklist.mjs @@ -49,7 +49,7 @@ function parseIsoDateOrTimestamp(value) { export function evaluateSecurityEvidence(value) { const failures = []; - const updatedAt = typeof value?.updated_at === "string" ? value.updated_at.trim() : ""; + const updatedAt = typeof value?.updated_at === "string" ? value.updated_at : ""; const updatedAtMs = parseIsoDateOrTimestamp(updatedAt); if (!isNonEmptyString(value?.owner)) {