Security: Improving OpenSSF Scorecard Rating (Targeting 7.0+)

[ecervantescelonis]

Description

Hi ArkType team! First of all, thank you for the incredible work on this library—the performance and TS-native developer experience are phenomenal.

Our organization is evaluating ArkType as a core validator, but we have a strict internal compliance policy requiring a minimum of 7.0 on the OpenSSF Scorecard audit before we can approve library adoption.

Currently, ArkType's scorecard sits at 5.8 / 10.

We would love to help or see if we can address a few low-hanging security hardening practices to push this score past 7.0. This would greatly benefit both our team and any enterprise-level developers looking to adopt ArkType.

---

Low-Hanging Fruit to Reach 7.0+

According to the OpenSSF Scorecard CLI tool, we can easily hit the compliance threshold by addressing these process bottlenecks:

1. Restrict GitHub Token Permissions (Currently 0/10)

Several workflows (including .github/workflows/pr.yml and publish.yml) do not have explicit top-level block permissions, defaulting to write-all.

• Remediation: Explicitly declare read-only permissions at the top of the workflow files:

  permissions:
    contents: read

[pullfrog]

  ^{｜ Build this ➔ ｜ Make a plan ➔}